Inside ULP Moon Stealer Logs: 657,356 Passwords Harvested

HEROIC identified a stealer log archive labeled ULP BY MOON_000006 distributed on Telegram in April 2025. This is the sixth volume in a series of credential dumps attributed to the MOON threat actor, containing 657,356 records. Each entry includes an email address, a plaintext password, and the URL of the service being accessed when the infostealer malware captured the victim's credentials.

657,356 Passwords With No Encryption Barrier

Every password in this massive dataset is recorded in plaintext, preserving the exact characters each victim typed. At this scale, the dataset represents a significant arsenal for credential exploitation. Automated tools can process all 657,356 entries rapidly, testing each credential pair against multiple services simultaneously. The absence of any cryptographic protection means there is zero delay between obtaining the dataset and launching attacks.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (diverse range of services and login endpoints)

Large-Scale Credential Stuffing From a Single Dataset

With 657,356 credential pairs, this ULP MOON volume provides enough material for extensive credential stuffing operations. Attackers feed these email-password combinations into botnets that distribute login attempts across thousands of IP addresses, evading rate limiting and detection systems. The scale means that even if only a small percentage of passwords are still valid and reused, the attacker still gains access to tens of thousands of accounts across banking, email, social media, and enterprise platforms.

Anatomy of the ULP MOON Stealer Log Operation

The ULP (URL Login Password) format is a standard structure used in stealer log distribution. The MOON series represents an organized operation that systematically collects and distributes stolen credentials in numbered volumes. Each volume aggregates data from thousands of devices infected with infostealer malware that hooks into browser credential stores, capturing every saved username, password, and associated URL. The numbered series suggests ongoing malware operations with regular harvesting cycles, indicating that new volumes with fresh credentials continue to appear.

Check If Your Credentials Were Exposed

The sheer size of this 657,356-record dataset means a wide range of users could be affected. HEROIC's breach scanner covers more than 400 billion compromised records, including all known ULP MOON volumes. Search your email address to find out if your credentials appear in this dataset or any related MOON series leaks, and take immediate action to change passwords and enable two-factor authentication on all sensitive accounts.