How a Stealer Log Led to 2.3 Million Logins in LeakBase 24Kk ULP

HEROIC analysts traced a stealer log called "24Kk ULP," attributed to the actor firegoon, back to a hacking forum post from June 21, 2024. The log contains 2,279,023 unique email addresses, each captured alongside a plaintext password and the website where the login was used.

Why This Is Dangerous

Every entry in this log is ready to use the moment it is downloaded. There is no password hash to crack and no guesswork involved, just a working email, password, and the exact site it unlocks. At more than 2.2 million records, this single log gives an attacker a ready-made list large enough to run automated attacks against major websites and see what still works.

What Was Exposed

• Email addresses
• Plaintext passwords
• Homepage URLs (the site each login was used on)

Why This Matters

Logs of this size are usually fed straight into credential stuffing software that tests each email and password pair against dozens of popular platforms automatically. If you are one of the 2,279,023 people in this file and have not changed your password since June 2024, an attacker could already have access to whatever account this credential unlocked, and to any other account where you used the same password.

How This Stealer Log Happened

Logs like "24Kk ULP" come from information-stealing malware that infects a victim's computer, typically delivered through a fake software crack, a malicious download, or a phishing email with an infected attachment. Once running, the malware searches the browser's saved login data and quietly copies out every stored email, password, and website address it finds, then sends that data back to the attacker. Because the malware collects credentials from whatever the victim had saved, a single infected device can hand over logins for dozens of unrelated websites, which is why this log spans so many different homepage URLs rather than data from one breached company.

Check If You Are Affected

With over 2.2 million records in this leak, the odds of your email being included are worth taking seriously. HEROIC's free breach scanner searches more than 400 billion exposed records, including this log, to tell you instantly if your credentials were caught up in it.