Stealer Log Explained: ‘Hotmail 159’ Leak Exposes 4,202 Logins

In October 2025, a file named "Good Emails.txt_Hotmail 159" appeared in a Telegram channel used to trade stolen credentials. The stealer log contained 4,202 records, each pairing an email address with a plaintext password and the URL the login was used on.

What "Hotmail 159" Actually Means

This is not a Microsoft or Hotmail security incident. The filename simply reflects that many of the harvested email addresses use Hotmail or Outlook domains, and "159" likely refers to a batch number the threat actor used to organize their files. The credentials themselves were pulled from individual computers infected with information-stealing malware, not from Microsoft's servers.

What Is a Stealer Log, Exactly

A stealer log is the output of infostealer malware, a type of program built to quietly copy saved passwords, autofill entries, and browser cookies from an infected device. Attackers then bundle everything into a text file, like this one, and sell or share it with other criminals. Because the malware captures whatever is saved in the browser at the time of infection, one log can contain logins for email, banking, shopping, and social media all at once.

What Was Exposed

• Email addresses, largely Hotmail and Outlook accounts
• Plaintext passwords tied to each address
• URLs showing exactly which site each login was used on

Why This Matters

With 4,202 working logins in one file, this is exactly the kind of data used for credential stuffing, where attackers automatically try each email and password pair across dozens of other websites. If you reuse passwords across accounts, one exposed Hotmail login can quickly turn into a takeover of your email, banking, or shopping accounts, and from there, identity theft and financial fraud become much easier for an attacker to pull off.

Check If Your Email Was in This Leak

Since this stealer log centers on Hotmail and Outlook addresses, anyone using those services should check their exposure. HEROIC's free scanner searches more than 400 billion breached records, including stealer logs like this one, and tells you in seconds if your email and password were part of it.