Online Service Accounts Exposed: MaitreCloud 5M ULP Leaked 13K Credentials

HEROIC analysts identified a stealer log dataset posted to BreachForums on January 5, 2025, by a threat actor known as "Maiitre." This release, labeled MaitreCloud 5M ULP, was the first installment in a series of three consecutive daily drops from the same actor, with subsequent files released on January 6 and January 7, 2025. The January 5 file drew from a pool of approximately 5 million raw credential records, yielding 13,471 unique email addresses, each accompanied by a plaintext password and the corresponding homepage URL for the site where the credentials were used. While smaller in unique account count than the later installments, this release confirms the actor's access to a pipeline of freshly harvested stealer malware output targeting users across multiple online services. See the other parts of this series: MaitreCloud 5M ULP 01/06/25 and MaitreCloud 5M ULP 01/07/25.

Why Online Service Users Are the Primary Target of Stealer Logs

Stealer malware is designed to harvest credentials from wherever users store them: browsers, password managers, email clients, and active session cookies. The users most at risk are those who rely on browsers to save passwords for banking portals, email providers, subscription streaming services, and workplace tools. When a single device is infected, every saved login becomes available to the attacker. The homepage URLs included in this dataset reveal exactly which services each victim used, giving attackers a precise roadmap for where to attempt unauthorized logins.

What Was Exposed in the MaitreCloud 5M ULP 01/05/25 Release

• Email addresses (13,471 unique accounts identified)
• Plaintext passwords requiring no decryption to use
• Homepage URLs identifying the specific sites targeted

Why This Matters: Credential Stuffing, Account Takeover, and Identity Theft

Plaintext credentials are immediately usable. Attackers can load them directly into automated tools that test login combinations against banks, email platforms, retail accounts, and corporate systems without delay. Successful logins can result in drained bank accounts, fraudulent purchases, identity theft through access to personally sensitive emails, and in workplace contexts, the deployment of ransomware or business email compromise scams. The presence of homepage URLs further accelerates this process by telling the attacker exactly where each set of credentials is most likely to work.

How Stealer Malware Harvests Online Credentials

Information-stealing malware targets the credential storage systems built into modern browsers and operating systems. When installed on a victim's device, typically through a phishing link, a cracked software download, or a malicious browser extension, the malware silently reads saved passwords, session cookies, and autofill data from every browser profile on the machine. It packages this information into a structured log file and transmits it to the attacker's server. These logs are then processed into ULP (URL-Login-Password) format and either sold privately or published in bulk on underground forums like BreachForums. The entire process from infection to data publication can happen within hours.

Check If You Are Affected

This release is the first of three consecutive daily drops in the MaitreCloud series, meaning total exposure across all three files is substantially larger. HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including stealer log collections like MaitreCloud. Visit heroic.com to run a free scan and determine whether your credentials are in circulation on underground markets.

Related Parts of This Breach

The MaitreCloud 5M ULP series was published across three consecutive days by the same threat actor on BreachForums. See the other installments:

• BreachForums MaitreCloud 5M ULP 01/06/25 by Maiitre
• BreachForums MaitreCloud 5M ULP 01/07/25 by Maiitre