Inside the LeakBase 10M ULP 12-08 Stealer Log: How Malware Harvested 2.7 Million Passwords

On December 8, 2024, a stealer log package labeled 10M ULP 12-08 appeared on a prominent underground forum under the LeakBase distribution banner, posted by threat actor 90437413a5. The dump contained approximately 10 million records, exposing 2,716,390 unique email addresses paired with plaintext passwords and homepage URLs. This was the second installment in a date-numbered series from the same actor -- the day prior, the same threat actor posted LeakBase 10M ULP 12-07, which exposed 1.67 million credentials. Together, these back-to-back drops represent a coordinated campaign of credential harvesting at scale, fueling the wider credential-stuffing economy.

Why This Stealer Log Is Dangerous

Stealer logs are among the most operationally ready threat assets circulating on dark web markets. Unlike hashed password dumps that require cracking, this dataset delivered plaintext passwords -- ready to use the moment they were downloaded. Paired with email addresses and homepage URLs that reveal which sites each victim actively uses, attackers can immediately attempt targeted account takeovers on banking, email, social media, and e-commerce platforms without any additional processing.

What Was Exposed in the 10M ULP 12-08 Breach

• Email Addresses -- 2,716,390 unique accounts identified as active targets
• Plaintext Passwords -- fully decrypted, immediately usable credentials
• HomePage URLs -- the specific websites where each credential was harvested, enabling precision targeting

Why This Matters: Credential Stuffing, Account Takeover, and Fraud

When attackers get their hands on plaintext email-password pairs tied to specific websites, the consequences move fast:

• Credential stuffing -- automated tools test these pairs across dozens of platforms simultaneously, exploiting password reuse
• Account takeover (ATO) -- once inside an account, attackers change recovery details, locking out the real owner
• Identity theft -- compromised email accounts serve as a master key to password resets across banking, insurance, and government portals
• Financial fraud -- access to e-commerce and banking accounts enables unauthorized purchases and fund transfers
• Dark web resale -- validated credential sets are packaged again and sold to additional threat actors, compounding the damage

How Stealer Logs Work: The Attack Vector Explained

Unlike a traditional database breach where a hacker penetrates a company's servers, stealer logs originate from information-stealing malware installed directly on victims' personal devices. Here is how the infection chain typically works:

1. Infection -- A victim downloads a trojanized file: a cracked software installer, a fake game mod, a malicious email attachment, or a drive-by browser exploit
2. Silent harvest -- The stealer malware runs in the background, extracting saved browser credentials, autofill data, session cookies, and clipboard contents
3. Exfiltration -- Harvested data is transmitted to an attacker-controlled server, typically bundled into a compressed log archive
4. Aggregation and sale -- Threat actors like 90437413a5 aggregate logs from multiple malware campaigns and post them on forums like LeakBase, often in date-stamped batches
5. Exploitation -- Buyers run credential-stuffing tools against the email-password pairs, targeting every site flagged in the homepage URLs

The "ULP" label in this dump stands for URL-Login-Password -- a standard stealer log format that makes the data especially dangerous because each credential is already mapped to the exact website where it was stolen.

Check If You Are Affected

The HEROIC Identity Scanner searches across more than 400 billion exposed records -- including stealer logs like this one -- to tell you instantly whether your email address or passwords have been compromised. If your credentials appear in the LeakBase 10M ULP 12-08 dump or any related breach, you will know immediately so you can act before attackers do.

Scan your email now at HEROIC.com -- it takes less than 30 seconds and costs nothing.

Related Parts of This Breach Series

The threat actor 90437413a5 released multiple date-stamped ULP packages in rapid succession. Other known parts of this series include:

• LeakBase 10M ULP 12-07 by 90437413a5 -- released December 7, 2024, exposing 1.67 million credentials