Alien ULP P749 Log: 13.5 Million Stolen Credentials Leaked Online

HEROIC analysts detected the Telegram alien ULP P749 stealer log on February 15, 2025, after it was posted to a Telegram channel associated with a threat actor operating under the "alien" handle. The log, cataloged internally as TXTLOG_ALIEN - 749, contained approximately 60.1 million lines of raw data. After deduplication, analysts confirmed 13,557,738 unique records. Each record links an email address to a plaintext password and a homepage URL, providing a ready-to-use credential package for anyone who downloads the file.

Why 60 Million Lines of Stolen Credentials Changes the Risk Equation

Volume matters in credential attacks. At 13.5 million unique records, the Alien ULP P749 log represents one of the larger single-drop stealer log releases tracked in February 2025. The homepage URLs paired with each credential set mean attackers do not need to guess which websites a stolen password belongs to. The target site is listed directly in the log. That turns a standard credential dump into a precision targeting tool, allowing attackers to skip the trial-and-error phase of credential stuffing and move directly to account access attempts on known platforms.

What Was Exposed in the Alien ULP P749 Log

• Email addresses: 13.5 million unique addresses serving as login identifiers across hundreds of platforms
• Plaintext passwords: Unencrypted passwords captured live from infected devices, usable immediately
• Homepage URLs: The specific websites tied to each credential, eliminating guesswork for attackers

Why This Matters: Credential Stuffing, Account Takeover, and Financial Fraud

Credential stuffing tools can process millions of login attempts per hour. A log of this size, with plaintext passwords already matched to specific websites, gives those tools everything they need to operate efficiently. Successful logins lead directly to account takeover, where attackers change contact details to lock out the real owner and then drain stored payment methods, redeem loyalty points, or use the hijacked account to send fraudulent messages. When financial accounts are involved, the path from stolen password to financial fraud can be measured in minutes. Password reuse across multiple services multiplies the damage, a single compromised credential can unlock banking, shopping, and email accounts simultaneously.

How the Alien ULP Stealer Log Series Works

The Alien ULP series represents a recurring operation, not a one-time event. Each installment, numbered sequentially (P747, P748, P749, P750), is distributed through the same Telegram channel, suggesting an organized actor or group systematically collecting and releasing stealer log data. The underlying mechanism is infostealer malware: software that runs silently on a victim's computer, harvests credentials saved in browsers and applications, and transmits them back to the attacker. These logs are then organized by volume, deduplicated, and released in numbered batches. The regularity of these releases indicates an active pipeline of compromised endpoints feeding continuous data into the series.

Check If You Are Affected by the Alien ULP P749 Breach

HEROIC's breach scanner cross-references your email address against more than 400 billion leaked records, including the full Alien ULP series. A free scan will tell you which of your credentials have been exposed, what specific data was leaked, and which breach it came from. If your email appears in the P749 dataset or any related log, you will know immediately so you can change affected passwords before an attacker uses them. Run your free check at HEROIC now.