Search Your Email: MrAwexx’s Second Hotmail Dump Exposed 386 Logins

In December 2025, HEROIC analysts identified a second stealer log from the same "MrAwexx" Telegram account, this one titled "Valid Hotmail By MrAwexx." The file contained 386 verified records, including email addresses, plaintext passwords, and the URLs each login was tied to. Posted just days after an earlier 661-record batch from the same source, this leak shows the account continuing to release freshly checked Hotmail credentials in smaller, regular drops.

Why This Is Dangerous

A steady stream of "valid" credential drops from the same source is dangerous precisely because of that consistency. Each of the 386 records in this file pairs a Hotmail email address with its plaintext password, already tested and confirmed to work, giving an attacker instant access without any need to guess or crack anything. Because this account appears to release verified batches on an ongoing basis, anyone who was missed in an earlier drop could easily turn up in one like this.

What Was Exposed

This leak included the following data types:

• Email addresses (Hotmail accounts)
• Plaintext passwords, verified as working
• URLs linked to each set of credentials

Why This Matters

Search your email against this leak, because a working Hotmail login can do far more damage than most people expect. Attackers use compromised inboxes to intercept password reset links, meaning a single stolen Hotmail account can be used to take over banking, shopping, and social media accounts that share no connection to Hotmail at all. Repeated drops like this one also feed ongoing credential stuffing campaigns, where each new batch of verified logins gets tested against dozens of other services.

How Stealer Logs Work

A stealer log comes from information-stealing malware, malicious software that quietly infects a device through fake downloads, cracked programs, or phishing links, then extracts saved browser passwords and active sessions. Sellers who label a log "valid" have taken the extra step of testing each credential before posting it, which is why accounts like MrAwexx tend to release smaller, frequent batches rather than one large unverified dump, each one representing freshly stolen and confirmed logins.

Check If You Are Affected

With verified stealer logs like this one appearing regularly, checking your email is the fastest way to know where you stand. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including validated stealer logs like this one, so you can find out in seconds and change your password before it is used against you.