Office 365 Stealer Log Leak: 248 Logins Exposed, Check Now

In April 2026, a threat actor uploaded a stealer log file to a Telegram channel containing 248 sets of Office 365 login credentials harvested from infected devices. The file, labeled "250 Office365 Valid Login Fresh APL," included email addresses, plaintext passwords, and the exact login page URLs tied to each credential pair. This is not a breach of Microsoft's own systems. It is a collection of logins already stolen by malware running on victims' computers, then packaged up and shared for anyone in the channel to grab.

Why an Office 365 Login Leak Is Dangerous

Office 365 is the front door to a person's work life. A single valid login can hand an attacker access to email, calendar invites, shared files in OneDrive or SharePoint, and internal contact lists. From there, an attacker can quietly read messages, reset passwords on other linked accounts, or send convincing phishing emails that appear to come from a real coworker. Because these credentials were captured in plaintext straight from an infected device, they work immediately, no cracking or guessing required.

What Was Exposed

• Email addresses used to sign in to Office 365
• Plaintext passwords, stored and shared with no encryption at all
• Login page URLs tied to each stolen credential pair

Why This Matters

Even a small batch of 248 credentials is enough to cause real damage. Criminals routinely take leaked email and password pairs like these and test them against banking sites, shopping accounts, and other work tools, a technique known as credential stuffing. If a password was reused anywhere else, that account is now at risk too. The end result can be full account takeover, identity theft, or direct financial fraud carried out under someone else's name.

How Stealer Log Credential Theft Works

This leak did not come from a hack of Office 365 itself. It came from infostealer malware, malicious software that infects a personal or work computer, often through a fake download, cracked software, or a malicious email attachment. Once installed, the malware quietly copies saved passwords, autofill data, and login sessions stored in the victim's browser, then sends everything back to the attacker. These stolen credentials are compiled into a "log" and sold or shared in bulk on Telegram channels and dark web forums, exactly what happened here. Buyers then test the logins to see which ones still work.

Check If You Are Affected

If you use Office 365 for work or personal email, it is worth finding out whether your login shows up in this leak or any other. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked and stolen records, including stealer logs like this one. Run a free scan now and find out if your credentials need to change today.