The Outlook Stealer Log Put 394 People at Risk of Identity Theft

HEROIC analysts identified this stealer log on May 12, 2026. The breach exposed 394 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Outlook uploaded by a Telegram User.

Why This Is Dangerous

This stealer log contains Outlook account credentials, including email addresses and plaintext passwords. Outlook accounts are tied to Microsoft services including OneDrive, Teams, Xbox, and in many cases work and school accounts. A stolen Outlook login can give attackers access not just to personal email but to a victim's entire Microsoft ecosystem, including files, contacts, and connected applications.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

The 394 stolen Outlook credentials in this breach expose victims to account takeover of their Microsoft accounts, identity theft, unauthorized access to linked services, and potential financial fraud if payment methods are stored in the account. Individuals who use their Outlook password on other platforms face the additional risk of those accounts being compromised through credential stuffing.

How a Stealer Log Works

Stealer malware is frequently distributed through malicious email attachments, fake software updates, and compromised download links. Once active on a device, it extracts passwords saved in browsers like Chrome, Edge, and Firefox, as well as credentials entered by the user. The resulting log files are bundled and shared through Telegram where attackers look for logins to specific email providers and services.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.