HEROIC Discovers 6,100 outlook.co.uk Logins in Stealer Log

HEROIC Discovers 6,100 outlook.co.uk Logins in a Telegram Stealer Log

HEROIC's threat intelligence team came across a stealer log on 21 June 2026 while monitoring Telegram channels used to trade harvested credentials. The file contained 6,100 records tied to outlook.co.uk, Microsoft's UK webmail service, each one pairing an email address with a plaintext password and the login URL where it was captured.

Why Discovering This Log Matters

Finding a log like this early gives people a chance to change their passwords before criminals put the data to use. Every credential here was stolen in plaintext directly from an infected device, meaning it is immediately usable, with no cracking or decryption required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each outlook.co.uk account

Why a Webmail Leak Like This Spreads Risk Further

Outlook accounts are frequently used to verify identity and reset passwords elsewhere, so a compromised outlook.co.uk login can lead to credential stuffing against banking and shopping accounts, unauthorized access, and in serious cases, identity theft or financial fraud.

How HEROIC Analysts Traced This Back to a Stealer Log

Stealer logs like this one originate from infostealer malware that infects a device, often through pirated software or a malicious download, then silently copies every saved password, cookie, and autofill entry from the browser. Criminals sort the stolen data by site and distribute the resulting files on Telegram, which is where HEROIC's analysts identified this outlook.co.uk batch.

Check If You Are Affected

If you use outlook.co.uk, check your exposure today. HEROIC's free breach scanner searches more than 400 billion breached and leaked records, including stealer logs like this one, so you can confirm whether your credentials were part of this discovery.