Alien ULP P784 Hit Telegram in March With 11M Stolen Passwords

HEROIC analysts identified the Alien ULP P784 stealer log on March 5, 2025, when it was released through a public Telegram channel. The log contained approximately 52.4 million lines of raw data, from which analysts extracted 11,273,578 unique records. Each record includes an email address, the associated plaintext password, and a homepage URL pointing to the site where that credential was active. This was not a breach of a single company. It is a mass harvest of real login credentials pulled directly from infected computers and dumped publicly where any criminal can download and use them.

Why Plaintext Passwords Make This Especially Dangerous

Most data breaches expose hashed passwords, which require time and computing power to crack. This leak is different. Every password in the Alien ULP P784 dataset is in plaintext, meaning it is immediately usable with no additional effort. An attacker downloads the file, picks an email address, and tries that exact password on banking sites, email providers, and social platforms. If the victim reuses passwords across services, every one of those accounts is at risk right now. The homepage URLs in the dataset also tell attackers exactly which service each credential belongs to, removing any guesswork.

What Was Exposed in the Alien ULP P784 Leak

• Email addresses, 11.27 million unique accounts identified
• Plaintext passwords, each directly usable without cracking
• HomePage URLs, identifying the specific site each credential was stolen from

Why This Matters Beyond the Initial Leak

Credential leaks like this one fuel a cycle that extends far beyond the original theft. Once an email and password pair is confirmed to work on one service, attackers use automated tools to test it against hundreds of others in a technique called credential stuffing. A single valid credential can unlock an email inbox, which then allows password resets on banking accounts, shopping sites, and cloud storage. Separately, plaintext passwords exposed here may reveal patterns in how people create passwords, enabling attackers to build smarter guessing lists for future attacks. The scale of 11 million records means the statistical chance of someone in your household being affected is not small.

How Stealer Logs Work

Stealer logs are created by infostealer malware, a type of malicious software that quietly runs on a victim's computer after they open a malicious file, click a compromised link, or install a fake app. Once installed, the malware scans browsers for saved passwords, active session cookies, and autofill data. It captures credentials as the user logs in, sending everything to a server controlled by the attacker. Those credentials are then packaged into logs and sold or distributed freely on platforms like Telegram. The Alien ULP series is one such recurring operation, with numbered batches indicating repeated, large-scale harvesting campaigns. The P784 designation suggests this is at minimum the 784th package in this particular series.

Check If Your Email Appeared in the Alien ULP P784 Leak

HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including stealer logs like this one. If your credentials appeared in the Alien ULP P784 dataset or any related leak, you will know immediately. Scan your email now at heroic.com and take action before someone else does.