SMF Hotmail Cloud Leak Makes Account Takeover Easier for 1,752 Users

HEROIC analysts found a combolist called Free Hotmail Combo by SMF Hotmail Cloud, uploaded to a Telegram channel on January 11, 2025. The file contains 1,752 records, each pairing a Hotmail email address with a plaintext password and the URL confirming where that login works.

Why This Is Dangerous

Calling a combolist "free" is how distributors attract as many downloads as possible, spreading the stolen data to a wider pool of people who might try to use it. Since the passwords sit in plaintext, anyone who grabs this file can log into these Hotmail accounts immediately, with no extra effort required to unlock the data.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

When a combolist is given away for free, it removes the usual barrier of price that limits who can access stolen credentials, meaning more people, including less experienced attackers, can attempt account takeover on these 1,752 Hotmail accounts. From there, a compromised inbox can lead to password resets on banking, shopping, and social media accounts, opening the door to financial fraud and identity theft.

How Combolists Work

A combolist bundles email or username and password pairs, typically gathered from stealer logs or older breaches, into a single file that can be used right away. Free combolists like this one are often released as a promotional sample to build a reputation before a seller offers larger, paid lists, which means the credentials inside have likely already been tried by more than one person.

Check If You Are Affected

With 1,752 Hotmail accounts now exposed in this leak, checking your own exposure only takes a moment. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combolists like this one, to tell you instantly if your email has been compromised. If it has, change that password everywhere you have reused it and turn on multi-factor authentication.