LeakBase 15Kk ULP #4 by firegoon

Our threat intelligence platform flagged an unusual spike in activity originating from a forum frequented by data brokers and credential stuffing actors. We noticed a new data dump, identified as "LeakBase 15Kk ULP #4 by firegoon," appearing on May 3, 2024. What struck us immediately was the inclusion of plaintext passwords alongside email addresses, a configuration that significantly lowers the barrier to entry for subsequent malicious activities. The sheer volume, while not record-breaking, is substantial enough to warrant immediate attention given the nature of the exposed credentials.

The "LeakBase 15Kk ULP #4" data breach, discovered on May 3, 2024, originated from a stealer log containing approximately 15 million records. Within this dataset, we identified 2,850 unique email addresses, each paired with its corresponding plaintext password and the user's HomePage URL. This combination is particularly concerning as it facilitates highly targeted credential stuffing attacks against both the compromised email accounts and any services where these users may have reused their credentials. The source structure suggests a compromise of user-side malware, likely a stealer, rather than a direct database exfiltration from a single enterprise. The leak location is a well-known hacking forum, indicating a ready market for this type of compromised information.

While this specific leak has not yet garnered mainstream media attention, similar incidents involving stealer logs are a persistent theme in OSINT and cybersecurity research. The prevalence of such logs on dark web forums underscores the ongoing efficacy of infostealer malware in harvesting sensitive user credentials. Researchers at various cybersecurity firms have consistently reported on the rise of these logs, highlighting their role in fueling large-scale account takeovers and subsequent fraud. The exposure of plaintext passwords, as seen here, directly contributes to the industry-wide challenge of managing password reuse and the cascading effects of compromised credentials.