DRAGON_ULP Leak Exposes 2.75 Million Stolen Passwords

HEROIC analysts uncovered a stealer log named "DRAGON_ULP 6" uploaded to Telegram on June 1, 2026, containing 2,754,308 records taken from infected devices. The file bundles email addresses, plaintext passwords, and the login URLs those credentials belong to.

Why This Is Dangerous

To put the size in perspective, 2,754,308 records is roughly the population of a mid-sized country, all condensed into a single downloadable file. Every one of those records is a working login paired with the exact site it opens, giving an attacker an enourmous head start compared to guessing passwords one at a time.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A file this large gives criminals the raw material for large-scale credential stuffing, where stolen logins are automatically tested against banking, email, and shopping accounts. When one of those attempts succeeds, it can lead directly to account takeover, followed by identity theft or financial fraud against the victim.

How Stealer Log Breaches Happen

Info-stealer malware typically spreads through cracked software, malicious ads, or phishing attachments. After infecting a device, it copies saved browser passwords, autofill entries, and session cookies, compiling them into a log sent back to the attacker. Those logs are then combined and dumped on Telegram channels and dark web forums, which is exactly how this 2.75 million record file appeared.

Check If You Are Affected

With a leak this large, checking your exposure only takes a moment. HEROIC's free breach scanner searches a database of over 400 billion compromised records, giving you a fast, clear answer on whether your information is part of this or any other breach.