807 Facebook Logins Leaked by Nullcyber Cloud on Telegram

807 Facebook logins. That is what HEROIC analysts found inside a ULP file uploaded to Telegram in October 2025 by a distributor calling itself Nullcyber Cloud. Each of the 807 records pairs an email address with a plaintext password and the Facebook login URL it unlocks, all pulled directly from infected devices through stealer malware.

Why This Is Dangerous

A Facebook account is more than just a social profile. It is often tied to Messenger conversations, saved payment methods, linked apps, and business ad accounts. Anyone holding these 807 credentials can log straight in, no guessing required, and start impersonating victims, messaging their contacts, or draining connected payment tools.

What Was Exposed

• Email addresses
• Plaintext passwords
• Facebook login URLs

Why This Matters

Attackers routinely feed stolen Facebook credentials into credential stuffing tools to test the same password against email providers, banking apps, and shopping sites. Because so many people recycle passwords across accounts, a single Facebook login can open the door to account takeover, identity theft, and financial fraud that reaches well beyond social media.

How Stealer Logs Work

Stealer malware infects a device through a fake download, cracked software, or malicious link, then quietly copies saved browser passwords and autofill data before packaging everything into a ULP file, short for URL-Login-Password. Groups like Nullcyber Cloud organize these files by platform, in this case Facebook, and timestamp them precisely to sell or trade on Telegram to buyers who specifically want social media accsess.

Check If You Are Affected

If you use Facebook, it is worth checking whether your login shows up in this leak or others like it. HEROIC's free breach scanner compares your email against a database of more than 400 billion exposed records, giving you a clear picture of your exposure so you can secure your account today.