Our Analysts Found the MrAwexx Hotmail Dump: 641 Logins Exposed

What HEROIC Analysts Found

In December 2025, HEROIC analysts identified a combolist file labeled "Hotmail Valid by MrAwexx," circulating on a Telegram channel. The file contained 641 records pairing Hotmail and Outlook email addresses with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

The word "valid" in this file's name means the credentials were tested and confirmed to work before being shared. Combined with a plaintext password and the exact login page for each account, this file gives an attacker a working key into over 600 Hotmail and Outlook inboxes.

What Was Exposed

• Email addresses (Hotmail and Outlook accounts)
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

Email inboxes like Hotmail and Outlook are often used to receive password reset links for other services, which means a confirmed working login can open the door to banking, shopping, or social media accounts too. Since this batch was verified before being shared, anyone whose credentials appear here should treat the risk of account takeover as immediate rather than theoretical.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, typically gathered from earlier breaches, stealer logs, or leaked databases. Sellers who label a batch "valid," as this one is, have already run the credentials through automated checker tools to confirm which ones successfully log in before distributing the file under their own name or handle.

Check If You Are Affected

If you use a Hotmail or Outlook email address, it is worth checking whether your login shows up in this leak or any other. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out quickly and update your password if needed.