The Alien ULP P740 Stealer Log Means Someone Could Log Into Your Accounts

HEROIC analysts flagged a large-scale stealer log distributed through a public Telegram channel on February 10, 2025. The file, labeled TXTLOG_ALIEN - 740 and shared by a threat actor operating under the name "alien," contained approximately 44.2 million lines of harvested data. After deduplication, analysts confirmed 8,377,843 unique email addresses, each paired with a plaintext password and the URL of the site where the credentials were used. This is not a breach of one company. It is a snapshot of millions of real people actively logging into their accounts, captured silently by malware running on their own devices.

What Someone Could Do With Your Email, Password, and Login URL

The pairing of a URL with credentials is what makes this log particularly dangerous. Attackers know exactly which site each password belongs to, so they do not need to guess or try multiple services. They go directly to the target. If your banking portal, work email, or social media account appears in this log, the attacker has a working login, in plain text, tied to that exact site. From there, account takeover takes seconds. Password resets, locked-out notifications, and fraudulent transactions often follow within hours.

What Was Exposed

• Email addresses (8.37 million unique)
• Plaintext passwords
• Homepage URLs revealing which site each credential belongs to

Why the Telegram Distribution Makes This Worse

Stealer logs shared on Telegram do not stay in one place. They are downloaded, re-shared, and folded into credential marketplaces within hours of posting. The "alien" threat actor has a documented history of distributing large ULP (URL-Login-Password) combolists through Telegram channels, some with thousands of subscribers. By the time HEROIC analysts observed this log, it had already been available long enough to fuel credential stuffing campaigns against hundreds of services. Your account could have been accessed without any notification to you.

How Stealer Logs Like TXTLOG_ALIEN - 740 Are Built

Stealer logs are the product of information-stealing malware. These programs infect computers through phishing emails, malicious downloads, or compromised software installers. Once running, they silently pull saved passwords from browsers, capture keystrokes during login events, and extract session cookies. The malware packages everything into a structured log file and sends it to an attacker-controlled server. Those logs are then sorted, deduplicated, and distributed or sold. TXTLOG_ALIEN - 740 is one such compiled output, representing infections across thousands of individual devices worldwide.

Check If You Are Affected by the Alien ULP P740 Leak

HEROIC's breach scanner searches across more than 400 billion records, including stealer logs like this one. If your email address appears in the TXTLOG_ALIEN - 740 dataset, you need to change the affected password immediately and enable two-factor authentication on any linked accounts. Run a free search now to find out exactly what was exposed before someone else acts on it first.