The LeakBase 20Kk ULP Dump: 2.3 Million Stolen Credentials Hit Dark Web

In November 2024, a stealer log identified as "20Kk Url:log:pass" and attributed to a threat actor known as firegoon appeared on a prominent underground hacking forum via LeakBase. The dataset contained approximately 20 million raw records, of which 2,321,901 were unique email addresses paired with plaintext passwords and homepage URLs. Unlike traditional database breaches, this exposure originated from infostealer malware deployed across compromised user endpoints, making it particularly dangerous because credentials were captured live, in the moment of use.

Why This Is Dangerous

Stealer logs represent one of the most immediately exploitable categories of leaked data. Because the passwords are stored in plaintext and were captured directly from browsers or applications on infected machines, they reflect credentials in active use at the time of infection. There is no hashing to crack, no transformation required. Any attacker who downloads this log can attempt to log into affected accounts within minutes.

What Was Exposed

• Email addresses: 2,321,901 unique accounts identified
• Plaintext passwords: Captured directly from infected devices, requiring no decryption
• Homepage URLs: Indicating the sites or services from which credentials were harvested
• Total raw records: Approximately 20 million lines in the source log
• Date of leak: November 18, 2024
• Platform: LeakBase underground forum

Why This Matters

Exposed plaintext credentials from stealer logs fuel a cascade of downstream attacks:

• Credential stuffing: Attackers run these email-password pairs against popular services including banking, email, and e-commerce platforms to find accounts where passwords were reused.
• Account takeover: Once inside an account, attackers can change recovery details, drain financial balances, or use the account as a pivot point for further attacks.
• Identity theft: Email access often unlocks password resets across dozens of linked services, providing attackers a master key to a victim's digital life.
• Phishing and fraud: Knowing which sites a user frequents (via homepage URLs) allows attackers to craft highly targeted phishing messages that appear legitimate.

How Stealer Malware Works

Infostealer malware is typically delivered through phishing emails, malicious downloads, or trojanized software installers. Once installed on a victim's device, the malware silently scans browser credential stores, saved logins, cookies, and autofill data. It packages this information into structured log files and transmits them to attacker-controlled servers. The resulting logs are then sold or shared on underground forums like LeakBase, where other threat actors purchase them for use in follow-on attacks. The entire cycle from infection to credential sale can occur within hours.

Check If You Are Affected

With over 400 billion records indexed, the Heroic Data Breach Search Engine is one of the most comprehensive tools available for checking whether your email address or credentials appear in known breach datasets, including stealer logs like this one. If your information was captured by infostealer malware, you need to know immediately so you can rotate passwords and enable multi-factor authentication before attackers strike.

Search your email now at Heroic.com to see if your credentials are exposed.