Inside the LeakyPro 60Kk Logs: How Stealer Malware Harvested 15M Passwords

HEROIC analysts flagged a large-scale stealer log posted on LeakBase on January 5, 2025, by a threat actor operating under the name "farmagol." The dataset, labeled LeakyPro 60Kk ULP, is part of a series by the same actor that includes a separate 33Kk ULP release also tracked on LeakBase. The 60Kk file contained approximately 61 million raw records, from which 15,098,267 unique email addresses were identified, each paired with a plaintext password and an associated homepage URL. This makes it one of the larger stealer log releases tracked in early 2025. The sheer volume of unique accounts means the probability that any individual email address is present in this dataset is significantly elevated. This is part of a series by the same actor. See the related release: LeakBase LeakyPro 33Kk ULP by farmagol.

Why 15 Million Plaintext Passwords Change Hands in Hours

Stealer log marketplaces like LeakBase operate as distribution hubs where stolen credentials move from the original harvester to downstream buyers within hours of posting. A dataset of this size, containing over 15 million unique plaintext email and password pairs, is immediately useful to anyone running credential stuffing operations. Because the passwords require no cracking, attackers can begin testing them against live services the moment the file is downloaded. With 15 million combinations to work through, even a 0.1% success rate against popular banking or email platforms represents tens of thousands of compromised accounts.

What Was Exposed in the LeakyPro 60Kk ULP Release

• Email addresses (15,098,267 unique accounts identified)
• Plaintext passwords ready for immediate use in credential stuffing
• Homepage URLs mapping each credential to a specific website or service

Why This Matters: How One Infected Device Fuels Mass Account Fraud

The scale of this release means exposure extends far beyond the initial infection event. Each credential in the dataset was stolen from a real person's device, typically without their knowledge. Once credentials are published on a forum like LeakBase, they are downloaded and redistributed by multiple actors simultaneously. This leads to waves of credential stuffing attacks, account takeovers on banking and financial platforms, identity theft, and in corporate environments, unauthorized access to internal systems that can escalate into full network compromises. The homepage URLs in this dataset give attackers a prioritized list of high-value targets to attempt first.

Inside Stealer Malware: How LeakyPro-Style Logs Are Created

Stealer malware, also known as information stealers or infostealers, are programs designed to extract credentials and session data from infected devices. Variants like RedLine Stealer, Vidar, and Raccoon Stealer are among the most prolific tools used to build these logs. The malware reaches victims through phishing emails disguised as invoices or shipping notices, fake cracked software distributed on piracy sites, malicious browser extensions, and drive-by downloads from compromised websites. Once active, the malware scans all browser profiles for saved login credentials, active session cookies, and autofill entries. It organizes these into ULP (URL-Login-Password) format and transmits them to the operator's command-and-control server. The operator then sells access to the logs or, as in this case, releases them publicly on underground forums to build reputation or trade for other services. The "60Kk" in the filename refers to the approximate total record count in thousands, indicating the dataset contained around 60,000 thousand (60 million) raw entries before deduplication.

Check If You Are Affected

With over 15 million unique email addresses in this single release, plus additional records in the related 33Kk ULP file from the same actor, the combined exposure is substantial. HEROIC's free breach scanner searches your email address against a database of over 400 billion compromised records, including large stealer log collections like the LeakyPro series. Visit heroic.com to run a free check and find out whether your credentials have been circulating on underground markets.

Related Parts of This Breach

The LeakyPro ULP series from actor farmagol includes multiple releases on LeakBase. See the related file:

• LeakBase LeakyPro 33Kk ULP by farmagol