Dark Web Intel: 18,156 Credentials From the Kayat-ULP Telegram Database Dump

HEROIC analysts detected the Kayat-ULP stealer log on dark web Telegram channels in June 2025. The file exposed 18,156 records containing email addresses, plaintext passwords, and URLs harvested from infected machines. The "ULP" designation stands for URL-Login-Password, a structured format widely used in the criminal underground to organize and sell stolen credential sets. This particular archive was distributed by a Telegram threat actor, making it immediately accessible to thousands of potential attackers with no technical skill required.

Why This Poses an Immediate Threat to Victims

ULP-format stealer logs are purpose-built for credential abuse. Each record contains not just an email and password, but the exact URL the password was used on, allowing attackers to skip the guesswork and go directly to the target service. With 18,156 records in plaintext, attackers can launch account takeover campaigns within hours of obtaning the file. Victims whose data appears here face risks ranging from hijacked social media to drained bank accounts.

Data Exposed in the Kayat-ULP Telegram Leak

• Email Addresses — primary identifiers used to log into virtually every online service
• Plaintext Passwords — no decryption or cracking required, ready for immediate use
• URLs — the exact websites each credential pair was stolen from, providing attackers a direct map to victim accounts

What Attackers Do With 18,000 Stolen URL-Login-Password Records

• Credential stuffing — automated bots test each email/password pair against banking, shopping, and email platforms
• Account takeover — successful logins are seized, passwords changed, and recovery options replaced
• Identity theft — email account access enables attackers to reset passwords for financial and goverment services
• Financial fraud — stored payment cards and banking sessions are exploited before victims notice unauthorized access

How ULP Stealer Logs Are Created and Distributed on the Dark Web

ULP (URL-Login-Password) stealer logs originate from infostealer malware infections on individual devices. After the malware silently extracts browser-saved credentials, it organizes the stolen data into structured text files sorted by URL. These archives are then compressed and uploaded to Telegram channels dedicated to credential trading, where they circulate freely or are sold for minimal cost. The Kayat-ULP file follows this exact pattern — a structured archive distributed via Telegram in June 2025. What makes ULP logs particularly dangorous is their organization: attackers do not need to figure out where to use each credential because the target site is already listed alongside every username and password.

Search the Kayat-ULP Leak and 400 Billion Other Breached Records Free

HEROIC's free breach scanner indexes more than 400 billion compromised records, including ULP stealer logs like the Kayat-ULP Telegram archive. If your email address appeared in this file or any other known data breach, HEROIC will tell you exactly what was exposed and when. Run your free scan at HEROIC.com today and find out what dark web actors may already have access to.