Researchers Found 1,600 Hotmail Logins in a Telegram Stealer Log

In June 2026, a stealer log labeled "Hotmail rangersupporttt" turned up on Telegram, containing 1,600 records taken from malware-infected devices. Each entry pairs a Hotmail-style email address with a plaintext password and the URL of the site it unlocks. This is not a breach of Microsoft's own systems. It is a collection of credentials pulled directly off individual users' computers by information-stealing malware and later shared publicly by a Telegram uploader.

How This Hotmail Log Was Discovered

Stealer logs like this one surface constantly on Telegram channels dedicated to trading stolen data, often posted with a short label describing what the file contains. This particular upload, tagged "rangersupporttt," was flagged as a Hotmail-focused log, meaning the majority of the 1,600 entries inside are tied to Hotmail or Outlook-style email addresses.

What Was Exposed in the 1,600-Record File

• Email addresses
• Plaintext passwords
• Login URLs tied to each account

Why a Smaller Leak Still Puts You at Risk

A file of 1,600 records is modest compared to some breaches, but that does not make it any less dangerous to the people in it. Plaintext passwords mean an attacker can log in without any extra effort, and if you reuse that same password anywhere else, credential stuffing lets them try it across other sites automatically. Account takeover, identity theft, and financial fraud can all follow from a single reused login.

How the Malware Behind This Log Operates

Infostealer malware typically arrives through a fake download, a cracked application, or a malicious attachment. Once it runs, it quietly copies saved passwords and session data from the browser and sends them to whoever controls the malware. Those results are then packaged into a log file, like this 1,600-record Hotmail set, and distributed through channels such as Telegram.

Check If Your Hotmail Account Was Exposed

Don't wait to find out the hard way whether your email is part of this leak. HEROIC's free breach scanner checks your address against more than 400 billion leaked records, including stealer logs like this one, and gives you an instant answer. Run a free scan now and update any passwords that come back exposed.