Email Users Targeted in the 12 Million Record Alien ULP P759 Leak

HEROIC analysts tracked the Alien ULP P759 stealer log back to February 20, 2025, when it surfaced on a public Telegram channel. The log, catalogued as TXTLOG_ALIEN - 759, contained roughly 51.3 million lines of raw output from infostealer malware. From that raw data, analysts extracted 12,304,460 unique records, each pairing a real email address with the corresponding plaintext password and the URL of the site where those credentials were used. This is not a breach of a single company. It is a large-scale credential harvest targeting individual users across a wide range of online services.

Why Anyone With an Online Account Is at Risk From the P759 Leak

Stealer logs target individual users, not companies. If your computer was ever infected by infostealer malware, your credentials may have been captured and included in a log like this one. The victims are ordinary people: shoppers, professionals, students, and anyone who saves passwords in a browser. With 12.3 million records in this single log, the affected pool is large enough to include people across every industry, country, and age group. The plaintext format of the passwords means no cracking is required. Anyone who downloads this file can immediately try these credentials on banking sites, email providers, and social media platforms.

What Was Exposed in the Alien ULP P759 Leak

• Email addresses, 12.3 million unique accounts identified
• Plaintext passwords, each ready to use without additional effort
• HomePage URLs, pinpointing the exact service each credential belongs to

Why This Matters for Credential Stuffing and Account Takeover

When attackers hold a verified email and password combination, the first thing they do is test it against other services automatically. This is called credential stuffing, and it works because a significant portion of people reuse the same password across multiple accounts. A single compromised credential from the P759 log could unlock an email inbox, which in turn allows an attacker to reset passwords on banking, shopping, and social accounts. The homepage URL field in this dataset accelerates the process further by telling attackers exactly where each password was active, enabling precise, targeted access attempts rather than broad guessing campaigns.

How Stealer Logs Like Alien ULP P759 Are Created

Infostealer malware is designed to run quietly in the background of an infected device. It activates when a user types a password or autofills a login, capturing the credentials before they are encrypted in transit. The malware also reads saved passwords directly from browser storage. Once collected, this data is packaged into structured log files and sent to remote servers controlled by the attacker. Those logs are then compiled into large batches and distributed through Telegram channels, where they are downloaded by other criminals for use in fraud campaigns. The Alien ULP series appears to be an ongoing operation producing numbered log batches at regular intervals, with P759 representing one installment in a much larger campaign.

Check If Your Credentials Appeared in the Alien ULP P759 Leak

HEROIC's breach scanner searches over 400 billion compromised records to check whether your email address appeared in the Alien ULP P759 dataset or any other known leak. The scan is free and takes seconds. Visit heroic.com to run your check now. If your email appears, change the affected password immediately and enable two-factor authentication on any account that uses it.