Your Hotmail May Already Be Compromised: 1,669 Non-2FA Logins Leaked

The "SMF Free Hot Mail Non 2FA" Combolist Gave Away 1,669 Hotmail Logins

On February 5, 2025, HEROIC's threat intelligence analysts identified a combolist labeled "SMF FREE HOT MAIL NON 2FA" being distributed by a user on Telegram. The file contains 1,669 records, each pairing a Hotmail-style email address with a plaintext password and the URL of the login page it unlocks. As the name suggests, the credentials were being given away for free, and every account was confirmed to have no two-factor authentication enabled. Most of the affected accounts are tied to the United States.

Why "Non 2FA" Makes These Accounts an Easy Target

Two-factor authentication is meant to be a second checkpoint that a stolen password alone cannot get past. By specifically filtering for accounts without it, whoever compiled this list guaranteed that every email and password pair could be used to log in directly, with nothing standing in the way. Giving that kind of list away for free only increases how many people might end up trying it.

What Was Exposed in This Hotmail Combolist

• Email addresses (Hotmail-style accounts)
• Plaintext passwords
• URLs linking each credential pair to its login page

Why a Free Leak Can Spread Faster Than a Sold One

Combolists that are sold tend to circulate among a smaller group of buyers who paid for access. A free one has no such barrier, anyone in the channel can download it and start testing accounts immediately. That wider reach means more chances for a password to be tried against other services, leading to credential stuffing, account takeover, or identity theft if enough personal information is reachable through the compromised inbox.

How Non-2FA Combolists Like This Are Assembled

Building a list like this involves collecting stolen credentials from older breaches, phishing pages, or malware infections, then testing each pair and specifically discarding any account protected by two-factor authentication. What is left is a smaller but far more usable list, since every remaining entry can be accessed with just an email and password. Files like "SMF FREE HOT MAIL NON 2FA" are then posted to Telegram channels or dark web forums for anyone to take.

Check If Your Email Was in This Leak

Because this list specifically targets accounts without two-factor authentication, it is worth checking both your credentials and your security settings. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records and tells you right away if you were exposed. If you find a match, change the password immediately and turn on two-factor authentication so your account cannot end up on a list like this again.