Inside the BabaUlpNew Logs: How Malware Harvested 96,154 Passwords

In November 2025, HEROIC analysts identified a stealer log uploaded to Telegram under the name BabaUlpNew 311 K ULP LINE. The file contained 96,154 records with email addresses, plaintext passwords, and the specific URLs where each credential was used. The data was harvested by infostealer malware running on real people's computers and then compiled and distributed freely through underground Telegram channels.

Why Malware-Harvested Credentials Are More Dangerous Than a Data Breach

When a company's database is breached, attackers typically get hashed passwords, which must be cracked before they can be used. The BabaUlpNew file is fundamentally different. Because the credentials were harvested directly from browsers as users typed or autofilled them, the passwords arrived already in plaintext. There is no additional work for an attacker. They open the file, pick an email and password pair, and start testing.

The URLs included in the file make this even more precise. Attackers know exactly which website each credential belongs to, so they can target the right login page immediately rather than spraying credentials broadly.

What the BabaUlpNew Stealer Log Exposed

• Email addresses (the primary username for most online services)
• Plaintext passwords (usable immediately with no cracking required)
• URLs (the exact websites each credential was associated with)

Why 96,154 Stolen Logins Translate Into Real-World Consequences

Once an attacker has a working email and password combination, the damage can spread fast. Email accounts are the master key to everything else. With access to your inbox, someone can reset passwords for your bank, your cloud storage, your social media, and any other service you have signed up for.

Credential stuffing tools make this process nearly instant. Automated software tests stolen credentials against hundreds of services simultaneously. People who reuse passwords across multiple accounts are definately at higher risk of losing access to several services at once. The 96,154 accounts in this file represent a significant pool of potential victims for this type of attack.

Inside the BabaUlpNew File: How Stealer Malware Works

The ULP in the file name stands for URL-Login-Password, which is exactly the format the data is stored in. This is a standard output format for infostealer malware programs. The malware itself is usually installed through phishing links, trojanized software, or malicious browser extensions.

Once installed, it monitors the browser's saved passwords, intercepts form submissions, and captures anything a user autofills. The harvested records are then transmitted to a command-and-control server, bundled into a file like this one, and shared in communities where attackers trade stolen data. The comprimised records from the BabaUlpNew file joined a long-running ecosystem of stolen credentials on Telegram.

Check If Your Credentials Are Inside the BabaUlpNew File

HEROIC has added the BabaUlpNew stealer log to its breach intelligence database, which now covers more than 400 billion records. You can run a free search using your email address to find out whether your credentials were part of this file or any other known breach. If your data appears, updating your passwords right away is the most effective way to reduce your exposure.