Dragon_ULP 7 Leak Means 2.7M Accounts Are Ready to Steal

HEROIC threat intelligence analysts identified a large-scale stealer log distribution labeled PRIVATE ULP BY DRAGON_ULP 7 on a Telegram channel in March 2026. The dump contained 2,739,813 records, each combining an email address with a plaintext password and the URL where those credentials were used. With nearly 2.8 million account credentials exposed in ready-to-use form, this leak represents one of the more significant stealer log distributions tracked by HEROIC in recent months.

Why These Plaintext Passwords Are an Open Invitation to Attackers

Every password in the Dragon_ULP 7 dump was stored without any form of encryption or hashing. The credentials appear in their original, human-readable format, exactly as victims typed them into login pages. For an attacker, this is the ideal scenario. There is no computational barrier, no time investment in cracking hashes, and no specialized hardware required. The passwords work the moment they are copied.

At the scale of 2.7 million records, the threat is acute. Automated attack frameworks can ingest this entire dataset and begin testing credentials against major platforms within minutes. Even a fraction of a percent success rate translates to thousands of compromised accounts, each one a potential gateway to financial theft, identity fraud, or corporate espionage.

What Was Exposed in the Dragon_ULP 7 Dump

• Email Addresses — Nearly 2.8 million email addresses extracted from infected endpoints, each serving as a login identifier and a direct channel through which attackers can deliver targeted phishing messages or password reset requests.
• Plaintext Passwords — Fully readable passwords siphoned from browser credential stores and login sessions on compromised devices, requiring no processing before they can be weaponized against victim accounts.
• URLs — The web addresses where each credential pair was captured, revealing the full scope of services each victim accessed and enabling attackers to prioritize high-value targets like banking, email, and enterprise platforms.

Why 2.7 Million Exposed Credentials Pose a Systemic Risk

A dataset of this magnitude does not just threaten individual users. It threatens entire organizations and platforms. When millions of credentials circulate freely, the volume of credential stuffing attacks against any given service spikes dramatically. Platforms that lack robust rate limiting or multi-factor authentication enforcement become easy prey.

For individuals, the risk is compounded by password reuse. Each person who used the same password across multiple services now has every one of those accounts exposed. An attacker who finds a working credential on a low-security site will immediately attempt it on email services, cloud platforms, financial institutions, and corporate networks. The 2,739,813 records in this dump could represent tens of millions of vulnerable accounts when reuse is factored in.

Corporate security teams face an additional concern. If any employee's personal device was infected by the infostealer that produced these logs, corporate credentials saved in the same browser are likely included in the dump alongside personal ones.

How Stealer Logs Enable Industrial-Scale Credential Harvesting

The Dragon_ULP series of stealer log compilations points to an organized operation. Infostealer malware variants like Lumma, Vidar, and RisePro infect devices through phishing campaigns, malicious advertisements, and compromised software distribution channels. Each infected machine yields a log file containing every credential, cookie, and autofill entry stored in the victim's browsers.

Operators behind these campaigns collect thousands of individual log files daily. They aggregate the data into large compilations, sometimes organized by geography, service type, or perceived value. The DRAGON_ULP label suggests a recurring distributor who periodically releases new batches, with the number 7 indicating this is at least the seventh installment in the series.

Distribution through Telegram provides the operator with reach and anonymity. Channels can attract thousands of subscribers who receive each new dump automatically. The data spreads rapidly, with multiple threat actors downloading and using the same credentials simultaneously, creating a race condition where the first attacker to test a valid credential claims the account.

Check If Your Credentials Are in the Dragon_ULP 7 Dump

Given the scale of this leak, verifying your exposure is essential. HEROIC offers a free breach scanner that searches more than 400 billion records from known breaches, stealer logs, and dark web marketplaces to determine whether your email address or passwords have been compromised.

If your credentials appear in the Dragon_ULP 7 dump or any related dataset, respond immediately. Change compromised passwords across every service where they were used, deploy a password manager to eliminate reuse, activate multi-factor authentication on all accounts, and run comprehensive anti-malware scans on every device to detect and remove any active infostealers.