Account Takeovers Surge as Alien ULP P750 Leaks 12.7M Passwords

HEROIC analysts flagged the Telegram alien ULP P750 stealer log on February 15, 2025, after it surfaced in a known threat actor channel on Telegram. The dataset, internally cataloged as TXTLOG_ALIEN - 750, contained approximately 57.7 million lines of raw log data. After deduplication, analysts confirmed 12,698,793 unique records, each pairing an email address with a plaintext password and a homepage URL. The scale of this leak places it firmly among the larger single-day stealer log drops tracked in early 2025.

Why Plaintext Passwords Make This Leak Especially Dangerous

Most data breaches expose hashed passwords, which require time and computing power to crack. This leak skips that step entirely. Every password in the Alien ULP P750 dataset is readable as-is, the same way you typed it. That means any attacker who downloads this log can immediately attempt to log in to email accounts, banking portals, streaming services, and anywhere else a victim reuses that password. The homepage URLs included in the dataset also give attackers a direct hint at which sites the credentials belong to, making targeted attacks faster and more precise.

What Was Exposed in the Alien ULP P750 Log

• Email addresses: 12.7 million unique addresses, usable as usernames across most online services
• Plaintext passwords: Full, unencrypted passwords captured directly from infected devices
• Homepage URLs: The websites associated with each credential pair, revealing which accounts were targeted

Why This Matters: From Stolen Passwords to Account Takeover

Credential stuffing is the attack that follows leaks like this one. Automated tools cycle through millions of email and password combinations, testing them against popular websites. Because a significant portion of internet users reuse passwords across multiple accounts, even a partial success rate on 12.7 million records translates to hundreds of thousands of compromised accounts. From there, attackers pivot: they drain stored payment methods, sell account access to others, or use hijacked email accounts to launch phishing campaigns against the victim's contacts. Identity theft and financial fraud are the downstream consequences most victims never see coming.

How Stealer Logs Work

Unlike a database breach where attackers hack a company's servers, stealer logs originate on the victim's own device. Infostealer malware, often delivered through phishing emails, malicious downloads, or cracked software, installs silently and harvests saved browser credentials, autofill data, and active session cookies. The malware then packages this data into a structured log file and transmits it to a command-and-control server. These logs are later compiled, deduplicated, and sold or shared in bulk through channels like Telegram. The Alien ULP P750 log represents one installment in an ongoing series distributed by the same threat actor, suggesting a sustained, organized operation rather than a one-time event.

Check If Your Email Appeared in This Breach

HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including stealer logs like the Alien ULP P750 dataset. If your credentials appear in this or any other known leak, you will see exactly what was exposed so you can take action before an attacker does. Run a free scan at HEROIC and find out in seconds whether your data is already circulating on the dark web.