Dragon_ULP 5 Leak Puts 2,975,667 Accounts at Risk of Takeover

One leak, one Telegram upload, nearly three million accounts affected. The Dragon_ULP 5 stealer log surfaced on June 1, 2026, carrying 2,975,667 records of email addresses, plaintext passwords, and the URLs those logins belong to, and the direct result is a massive pool of accounts now sitting at risk of takeover.

Account takeover is not a relevant threat only for the people who click on obvious scams, it can happen to anyone whose credentials end up in a file this large.

Why This Is Dangerous

When passwords are stored in plaintext, as they are throughout this leak, there is no barrier between a downloaded file and a criminal actually logging into your accounts. With 2,975,667 sets of credentials in circulation, attackers can work through the list methodically, checking which passwords still work and quietly taking over whichever accounts they can access.

What Was Exposed

• Email addresses for 2,975,667 accounts
• Plaintext passwords tied to each address
• URLs showing the specific services affected
• 2,975,667 total records confirmed in the Dragon_ULP 5 leak

Why This Matters

Account takeover is the direct consequence when a leak this size gets loose. Once someone else controls your email or a linked account, they can lock you out, reset other passwords through it, or use it to reach your contacts. A leak of 2,975,667 records essentially hands attackers the keys to millions of front doors at tommorow's convenience, whenever they get around to trying them.

How Stealer Logs Work

Stealer malware infects devices silently, often bundled inside pirated software or fake installers, and then harvests every saved password and autofill value it can find from the browser. Those individual harvests get combined across many infected machines into one giant file, in this case Dragon_ULP 5, which then gets distributed through Telegram channels.

Check If You Are Affected

Given the size of this leak, checking your exposure only takes a minute. HEROIC's free breach scanner compares your email against more than 400 billion breached records from the dark web so you know immediately if your accounts need attention.