The LeakBase TXTLOG_ALIEN 134M ULP Gave Hackers 13.6 Million Login Pairs to Exploit

On November 13, 2024, a dataset titled 134M Lines Url Login Pas Txtlog Alien was posted to a prominent hacking forum. The dump contained approximately 134 million records split across 15 parts, with our analysis confirming 13,629,495 unique email addresses each paired with a plaintext password and the homepage URL of the site the credential belongs to. This is part of the ongoing TXTLOG_ALIEN campaign, a series of large-scale stealer log releases from the same threat actor that has collectively exposed hundreds of millions of stolen login pairs. Hackers do not need to crack anything. Every password in this dataset is already in plaintext and ready to use.

Why This Is Dangerous

A 134-million-record stealer log is not a passive data artifact. It is an operational weapon. The TXTLOG_ALIEN series is distinctive because of its scale, consistency, and organization: logs are split into numbered parts, labeled by total line count, and distributed across multiple underground channels to maximize reach. The 13.6 million unique email-password pairs in this release represent 13.6 million immediate attack opportunities against any service where those users have reused their password.

What Was Exposed

• Email addresses: 13,629,495 unique addresses confirmed
• Plaintext passwords: Unencrypted, immediately usable without any cracking
• HomePage URLs: The specific site each credential was stolen from, giving attackers precise targeting data
• Total records: Approximately 134 million entries across 15 parts
• Distribution: Posted to LeakBase on November 13, 2024, as part of the broader TXTLOG_ALIEN campaign

Why This Matters

With 13.6 million ready-to-use credential pairs, attackers have everything they need to execute:

• Credential stuffing at scale: Automated tools can test all 13.6 million pairs across hundreds of platforms within days, compromising every account where the password was reused.
• Account takeover: Email account access enables attackers to reset passwords on banking, investment, and e-commerce platforms, triggering a cascade of downstream compromises.
• Identity theft: Email plus a known service URL provides enough context to impersonate victims and initiate fraudulent transactions or SIM swap attacks.
• Fraud and financial crime: The homepage URL field lets attackers prioritize high-value targets such as banking and cryptocurrency sites within the dataset.

How the TXTLOG_ALIEN Stealer Campaign Works

TXTLOG_ALIEN is a structured credential-harvesting operation built on infostealer malware distributed through malvertising, phishing, and fake software downloads. Infected devices silently export saved browser credentials, session cookies, and autofill data to the operator's collection infrastructure. The operator then aggregates logs from multiple infection waves, deduplicates and sorts them, and releases them in numbered batches on underground forums. The 15-part structure of this 134M release is characteristic of that workflow: a large batch processed and distributed methodically rather than dumped all at once. Other releases in this series have been documented across BreachForums and Telegram.

Related Parts of the TXTLOG_ALIEN Series

This dataset is one release in a larger ongoing campaign. Other documented TXTLOG_ALIEN releases include:

• Your Password Might Be In the 22.5M TXTLOG_ALIEN 114M ULP Leak
• How Stealer Malware Produced the TXTLOG_ALIEN 104M ULP Leak
• How HEROIC Traced the 20.2M TXTLOG_ALIEN 89M ULP Credential Dump
• Account Takeover Just Got Easier Because of TXTLOG_ALIEN: 41 Million Passwords Exposed on BreachForums
• The TXTLOG_ALIEN - 703 Leak Put 10 Million Stolen Email and Password Pairs on Telegram

Check If You Are Affected

HEROIC indexes over 400 billion compromised records, including the full TXTLOG_ALIEN series. Search your email address now to find out whether your credentials appear in this release or any related dump in the campaign.

Check your exposure free at HEROIC Identity Guard

What to Do If Your Data Was Exposed

• Change passwords immediately on any account associated with an exposed email address, prioritizing email, banking, and any site containing financial information.
• Enable multi-factor authentication on all critical accounts, starting with your primary email.
• Run a scan for infostealer infections on any device you use regularly - your credentials may have been stolen from your machine directly.
• Monitor your accounts for unauthorized activity, unrecognized sessions, or password reset emails you did not initiate.