HEROIC Analysts Uncover the ALIEN_LOG Leak of 117,093 Passwords

HEROIC analysts identified a stealer log file called ALIEN_LOG that was uploaded to a public Telegram channel on June 10, 2025. The file contains 117,093 records taken from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts and services those passwords open. Because the data was harvested directly from compromised browsers rather than a hacked company database, every credential inside reflects a real, working login at the time it was collected.

Why the ALIEN_LOG Leak Is Dangerous

Every password in this log is stored in plaintext, so there is no encryption standing between an attacker and the account it protects. Paired with the URL for each entry, the log tells an attacker exactly which site or service a stolen login opens, removing the guesswork that would normally slow down an account takeover attempt.

What Was Exposed in the ALIEN_LOG Leak

• Email addresses
• Plaintext passwords
• URLs identifying the exact site or service tied to each login

Why 117,093 Exposed Passwords Is a Serious Number

A log of this size is large enough to power widespread credential stuffing campaigns, where attackers test the same email and password combination against banking sites, email providers, and shopping platforms within minutes. Anyone who reused one of these passwords elsewhere faces a real risk of account takeover, along with the identity theft and financial fraud that often follow once an attacker gains access to an email or banking account.

How a Stealer Log Like ALIEN_LOG Gets Created

Stealer logs are not the result of a company being hacked. They come from malware quietly installed on a person's device, often through a fake download, cracked software, or a malicious attachment, that scans the browser for saved logins and copies the email, password, and web address for each one it finds. That data is sent back to whoever controls the malware, who packages it into a log file like this one and distributes or sells it through channels such as Telegram.

Check If Your Email Is in the ALIEN_LOG Leak

If you want to know whether your email address turned up in this leak or any other, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a free scan now and change any passwords you have reused across multiple accounts.