Dark Web Intel: 865 Credentials From live.com Are Now Public

HEROIC analysts identified this stealer log on 12-Jul-2026. The breach exposed 865 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as live.com uploaded by a Telegram User.

Why This Is Dangerous

This breach contains 865 live.com email addresses paired with their plaintext passwords. Because these credentials are now publicly available on the dark web, any person who finds this file can immediately attempt to log into those Microsoft accounts, which often provide access to email, OneDrive, Xbox, and linked services.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (website addresses connected to the stolen login credentials)

Why This Matters

Live.com accounts are Microsoft accounts, meaning a single stolen credential can provide access to email, cloud storage, productivity tools, and any other service linked to that Microsoft identity. Attackers also test these credentials across other platforms using credential stuffing, multiplying the risk across every site where the same password is used.

How Stealer Logs Work

A stealer log originates from malware that infects a device and silently records every username and password the user enters. This malware typically spreads through phishing emails, deceptive software installers, or compromised browser extensions. The captured credentials are then packaged and uploaded to dark web forums and private Telegram channels, where they become available to any criminal who finds or purchases the file.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.