GHOST ULP FREE 2: Telegram Stealer Log Exposes 46,927 Logins

GHOST ULP FREE 2 landed in a Telegram channel in October 2025, and inside it were 46,927 records, the digital fingerprints of real accounts belonging to real people who have no idea their existance was just handed to strangers.

Why This Is Dangerous

ULP is short for username, login, password, and that's exactly what this file delivers on a silver platter. There is no encryption to break and no password hash to crack. Someone opens the file, picks a target, and logs straight into an account using the exact same email and plaintext password that was stolen from the victim's browser.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs linking each credential to its source site
• 46,927 total records exposed

Why This Matters

The name GHOST ULP FREE 2 tells you something too, this isn't the first log from this source and it likely won't be the last. Whoever is behind it is running an operation, feeding fresh stolen credentials to a public channel on a recurring basis. Anyone whose data lands in one of these files should assume it will circulate untill someone finally changes the password.

How Stealer Logs Work

Behind every ULP file is a piece of malware that infected a device, likely through a cracked download or a phishing link, and then quietly copied every password saved in the browser. Once the malware operator has enough stolen logins to recieve a decent profit, they compile everything into a file like this one and either sell it privately or give it away to build a following on Telegram.

Check If You Are Affected

You do not need to track every Telegram channel trading in stolen logins to know if you are at risk. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including files like GHOST ULP FREE 2, so you can find out in seconds and update any password that turns up compromised.