Researchers Link the LeakBase StarLinkClouds 45M ULP to 10.6 Million Stolen Plaintext Credentials

HEROIC analysts flagged a large credential dump posted to a prominent hacking forum on December 22, 2024, attributed to a threat actor operating under the name VitVit. The dataset, titled "LeakBase StarLinkClouds 45M ULP," contained approximately 47 million total records with 10,607,791 unique email addresses. What made this discovery immediately alarming was the format: email addresses paired with plaintext passwords and associated homepage URLs, the signature output of credential-stealing malware deployed at scale. This is part of an ongoing series of stealer log releases from the same actor. Related dumps in this series include the LeakBase StarLinkClouds 33M ULP by VitVit and the LeakBase STARLINK 19M ULP by VitVit.

Why the LeakBase StarLinkClouds 45M ULP Dump Is Dangerous

Plaintext passwords require no cracking. Any attacker who downloads this dataset can immediately begin testing these credentials against email providers, banking platforms, social media accounts, and corporate login portals. Stealer logs also include the homepage URLs that were active in the victim's browser at the time of infection, revealing which services each person actively used. This makes targeted attacks far more precise and effective. With over 10 million unique accounts compromised, the scale of potential credential stuffing attacks downstream is substantial.

What Was Exposed in the LeakBase StarLinkClouds 45M ULP Breach

• Email addresses (10,607,791 unique)
• Plaintext passwords
• Homepage URLs

Why This Matters: Credential Stuffing and Account Takeover at Scale

Stealer logs containing plaintext passwords are among the most immediately actionable data types in the cybercrime ecosystem. Credential stuffing tools can test millions of email and password combinations against dozens of platforms within hours. Financial fraud follows quickly when attackers gain access to online banking or payment accounts. Corporate accounts compromised through personal password reuse can lead to ransomware deployment or data exfiltration within enterprise environments. The homepage URL data also enables spear-phishing attacks targeting specific services known to be used by each victim.

How Stealer Malware Harvests Credentials

Stealer malware, also called an infostealer, is typically delivered through phishing emails, malicious software downloads, or compromised websites. Once installed on a victim's device, it silently extracts saved passwords from browsers, captures keystrokes, and reads session cookies that authenticate a user to websites without requiring a password. The harvested data is packaged into logs and sent back to the attacker. These logs are then compiled and sold or published on dark web forums and leak sites. Unlike traditional breaches that target a single organization, stealer logs aggregate credentials from thousands of different services at once.

Check If Your Data Was Exposed

HEROIC's breach scanner searches across more than 400 billion compromised records to determine whether your email address has appeared in stealer logs or data breaches like the LeakBase StarLinkClouds 45M ULP dump. If your credentials were part of this release, you should change the exposed password immediately on every service where it was used and enable two-factor authentication across your accounts. Run a free scan at HEROIC.com to find out if your information has been compromised.

Related Parts of This Breach

The LeakBase StarLinkClouds 45M ULP is one of several stealer log dumps released by the VitVit actor. See the related releases below:

• LeakBase StarLinkClouds 33M ULP by VitVit
• LeakBase STARLINK 19M ULP by VitVit