Search Your Email: Valid Hotmail by MrAwexx Exposed 1,056 Logins

In early December 2025, HEROIC analysts identified a stealer log titled "Valid Hotmail by MrAwexx" circulating on Telegram, exposing 1,056 records. The file contains Hotmail email addresses, plaintext passwords, and the URLs of the login pages those credentials were pulled from.

Why This Is Dangerous

The word "Valid" in this file's name means the credentials have already been tested and confirmed to work, so an attacker does not need to guess which accounts are still active. Because a Hotmail or Outlook inbox is often the recovery address for banking, shopping, and social media accounts, gaining access to one email account can quickly cascade into control over several others.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

With 1,056 confirmed working logins, this file is ready for immediate abuse. Criminals can use tools to automatically attempt each email and password pair against other popular sites, a technique called credential stuffing, or log directly into the Hotmail accounts themselves to read private messages, reset other passwords, or impersonate the account owner, leading to account takeover, identity theft, or financial fraud.

How Stealer Logs Work

Stealer logs come from infostealer malware that infects a victim's device, typically through a fake download, cracked software, or malicious attachment, and then quietly harvests saved browser passwords and the web addresses they belong to. Sellers or distributors often test the harvested credentials before release and label the results "valid," as seen here, before sharing them in private Telegram channels.

Check If You Are Affected

With over a thousand confirmed working Hotmail logins in this file, checking your exposure is worth doing now. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly whether your credentials were part of this leak and update your password before someone else uses it.