Global Users Hit: ULP Moon SUPP1 Exposes 1,255,549 Passwords

HEROIC identified a stealer log archive labeled ULP GOOD BY MOON_SUPP1_000004 distributed on Telegram in May 2025. Part of the supplementary series within the MOON threat actor's credential distribution operation, this dataset contains 1,255,549 records. Each entry captures an email address, a plaintext password, and the URL of the service the victim was accessing when the infostealer malware intercepted their login credentials.

1.25 Million Plaintext Passwords in a Single File

The scale of this leak is staggering. All 1,255,549 passwords are stored in plaintext, completely unprotected and instantly usable. With over 1.25 million credential pairs available, this supplementary MOON volume represents an enormous repository of working login details. No cracking, no decryption, no technical expertise is required. Any individual or automated system that accesses this file can begin exploiting credentials immediately.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (services spanning all industries and geographic regions)

Multi-Industry Credential Stuffing at Massive Scale

With 1,255,549 credential pairs spanning users worldwide, this dataset enables credential stuffing campaigns of extraordinary breadth. Attackers can target financial services, healthcare platforms, educational institutions, government portals, e-commerce sites, and enterprise systems all from a single file. The supplementary nature of this volume suggests it contains credentials that complement the main MOON series, potentially including previously unindexed accounts, making it a high-priority dataset for attackers building comprehensive credential databases.

The MOON Supplementary Series: Expanding the Threat

The MOON operation distributes stolen credentials in both primary and supplementary volumes. The SUPP1 designation indicates a curated supplement that adds new credential entries to the main MOON database. Each volume aggregates data from infostealer malware infections across thousands of devices worldwide. The malware captures saved browser credentials, cookies, and session tokens, then packages them into standardized ULP (URL Login Password) format files. The supplementary series extends the operation's reach by incorporating new infections and previously uncollected credentials into the distribution pipeline.

Check If Your Credentials Were Exposed

At 1,255,549 records with global reach, this dataset affects users across every industry and region. HEROIC's breach scanner indexes more than 400 billion compromised records, including all known MOON series volumes. Search your email address to find out if your credentials appear in this supplementary dataset or any other known breach. If your login information is exposed, change your passwords immediately and enable two-factor authentication on every account that supports it.