Inside MrAwexx Stealer Logs: 1,019 Hotmail Passwords

HEROIC's threat intelligence systems flagged a stealer log file titled "1K Valid Hotmails MrAwexx" on Telegram, dated December 2025. Unlike raw stealer log dumps, this dataset has been curated by a threat actor operating under the handle "MrAwexx" who verified that each of the 1,019 Hotmail credentials in the file is valid and working. This validation step makes the dataset significantly more dangerous than unverified credential dumps.

Pre-Validated Plaintext Passwords Amplify the Threat

The 1,019 passwords in this file are not only stored in plaintext but have been tested and confirmed to work at the time of compilation. Most stealer log dumps contain a mix of active and expired credentials, but MrAwexx's curation process has filtered out dead entries. This means every password in the file represents an account that was accessible when the list was compiled. For affected Hotmail users, there is a high likelihood that attackers have already accessed their accounts.

What Was Exposed

• Email Addresses — verified Hotmail accounts confirmed to be active at the time of the leak
• Plaintext Passwords — tested, working credentials ready for immediate account access
• URLs — login endpoints and services associated with each stolen credential pair

Verified Credentials and the Credential Stuffing Threat

Pre-validated credentials are premium commodities in underground markets. Because each of the 1,019 email-password pairs has been confirmed to work, attackers can bypass the trial-and-error phase of credential stuffing and proceed directly to account takeover. They will test these Hotmail credentials against Microsoft services like Outlook, OneDrive, and Teams, as well as third-party platforms where users registered with their Hotmail address. The high success rate of verified credentials makes this dataset a potent weapon for targeted attacks.

Technical Breakdown: How MrAwexx Harvested and Validated Credentials

The pipeline behind this dataset involves multiple stages. First, infostealer malware such as RedLine, Raccoon, or Vidar infects victim devices through phishing or malicious downloads. The malware extracts saved passwords from browsers, captures autofill data, and steals session cookies. The raw logs are then processed by operators like MrAwexx who sort credentials by email provider, run automated validation scripts against Hotmail's login API to confirm which passwords still work, and package the verified results into curated lists. This refined dataset commands a higher price and poses a greater threat than unfiltered stealer logs.

Check If Your Credentials Were Exposed

With over 400 billion records in its breach intelligence database, HEROIC provides comprehensive coverage of stealer logs, data breaches, and dark web credential dumps. Use the HEROIC breach scanner to check whether your Hotmail address or password appears in the MrAwexx dump or any other known breach. Given that these credentials were pre-validated, immediate password changes and enabling multi-factor authentication are strongly recommended for anyone who finds a match.