Dark Web Intel: UP_KURZL0G 3 ULP Leak Exposes 846,080 Logins

A stealer log file quietly surfaced on Telegram in October 2025, and it wasn't small. The dump, tracked by HEROIC as BONUS ULP UP_KURZL0G 3, contains 846,080 records lifted straight from infected devices. Whoever uploaded it didn't need to hack a company's servers directly, they just collected what malware had already stolen from ordinary users.

Why This Is Dangerous

Stealer logs are a bit different from your typical corporate data breach. Instead of one company's database getting popped, this kind of leak comes from malware sitting on peoples computers, quietly grabbing whatever passwords and session data it can find. That means the passwords in this file are the actual, current, plaintext ones people were using at the moment their machine got infected. There is no hashing to crack and no guessing involved, its already sitting there in the open, ready for anyone who downloads the file to use imediately.

What Was Exposed

• 846,080 total records
• Email Addresses
• Plaintext Passwords
• URLs tied to the accounts logged in

Why This Matters

When a password shows up in plaintext, it means anyone who recieves the file can log in immediately, no cracking tools needed. And because so many people reuse the same password across multiple sites, one exposed login can quickly turn into access for email, banking, or social media accounts too. The URLs included in this leak make it even easier for attackers to know exactly which sites to try each credential on.

How Stealer Logs Work

Stealer malware infects a device, often through a cracked game, fake software installer, or malicious email attachment, then it seperates out anything valuable it can find: saved browser passwords, autofill data, cookies, and even cryptocurrency wallet details. All of that gets packaged into a log file and shipped back to whoever is running the malware. From there it gets sold, traded, or in this case, dumped for free in a Telegram channel where anyone can grab it.

Check If You Are Affected

If you use any of the same passwords across more than one account, now is a good time to check. HEROIC's free breach scanner searches across more than 400 billion leaked records, including stealer logs like this one, to tell you whether your email or credentials have shown up somewhere they shouldn't be. It takes a minute and could save you a lot of trouble down the road.