If You Use Hotmail, the MrAwexx Leak of 661 Logins Should Worry You

In December 2025, HEROIC analysts identified a stealer log named "1K Hotmail Valid By MrAwexx" circulating on a Telegram channel. Despite the "1K" in the name, HEROIC's analysis confirmed 661 verified records in the file, including email addresses, plaintext passwords, and the URLs each login was tied to. The "Valid" label indicates the accounts had already been checked to make sure the passwords still worked at the time the file was posted.

Why This Is Dangerous

If you use a Hotmail or Outlook account, a leak like this should concern you directly. Every one of the 661 records pairs an email address with its exact plaintext password, already confirmed to work, so an attacker does not need to guess or test anything before logging in. Because email accounts are typically used to reset passwords on other services, gaining access to your inbox can hand an attacker the keys to accounts far beyond Hotmail itself.

What Was Exposed

This leak included the following data types:

• Email addresses (Hotmail accounts)
• Plaintext passwords, verified as working
• URLs linked to each set of credentials

Why This Matters

Even at 661 records, a "validated" list like this is more dangerous than an unverified leak of the same size, since every credential has already been confirmed active. If you reuse your Hotmail password anywhere else, this leak puts your banking, shopping, and social media accounts at risk of credential stuffing and account takeover. A compromised email account can also be used to intercept password reset emails, letting an attacker lock you out of other accounts entirely.

How Stealer Logs Work

A stealer log is produced by information-stealing malware, malicious software that infects a device through fake downloads, cracked software, or phishing links. Once running, it collects saved browser passwords, autofill data, and active sessions, then sends everything back to the attacker as a file. What makes a "valid" list like this one different is the extra step sellers take to test each credential before distribution, weeding out expired accounts so buyers get a higher success rate, which is why validated stealer logs are often sold rather than given away for free.

Check If You Are Affected

Whether a leak involves 661 records or 6 million, the only way to know for certain is to check. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including validated stealer logs like this one, so you can find out quickly and change your password before someone else logs in first.