The LeakBase ULP Kall Stealer Log Put 62,386 Login Pairs Online
On October 31, 2024, a stealer log known as "ULP Kall by sirdr" surfaced on a well-known underground hacking forum, containing credential data harvested from malware-infected devices. While the original post claimed 567,000 entries, analysis confirmed 62,386 unique records in the exposed dataset. Each record contains an email address, a plaintext password, and the URL of the website where those credentials were used — giving anyone who downloads the log instant, ready-to-use access to real accounts.
This log is part of the ongoing LeakBase ULP (URL:Login:Password) series, a recurring format used by multiple threat actors to share harvested credential data. See Related Parts below for other entries in this series.
Why This Is Dangerous
Plaintext passwords are the most dangerous type of credential leak. There is no hashing to crack, no decryption needed — these are live, working passwords that can be copied directly into a login form. Combined with the URL that identifies exactly which site to target, this data functions as a complete account-access kit.
What Was Exposed
- Email addresses
- Plaintext passwords
- Homepage URLs (the target websites for each credential pair)
A total of 62,386 unique records were confirmed from a claimed dataset of approximately 567,000 entries.
Why This Matters
Stealer log credentials are immediately actionable. Threat actors with access to this data can:
- Attempt credential stuffing across banking, email, and e-commerce platforms
- Execute account takeover on any site where the exposed password was reused
- Enable identity theft by combining account access with profile data found inside those accounts
- Resell verified working credentials for financial fraud or further exploitation
How Stealer Logs Work
Stealer logs are produced by infostealer malware — malicious software silently installed on a victim's device through phishing links, cracked software downloads, or malicious browser extensions. Once active, the malware scrapes saved passwords from browsers and applications, recording the site URL alongside the credential. These logs are then packaged and posted to forums or sold privately. Because the credentials are harvested directly from the device rather than from a breached server, they often bypass detection and represent some of the freshest, most actionable stolen data in circulation.
Check If You Are Affected
If your device has ever been infected with infostealer malware, your credentials may have been collected and distributed without your knowledge. Heroic's breach search engine indexes over 400 billion leaked records including stealer log data. Search your email address now to find out if your credentials are in circulation.
Search Heroic's 400B+ Record Database Now
Related Parts
LeakBase ULP is a recurring series of credential dumps posted to underground forums by multiple actors. Other entries in this series include:
Breach Breakdown
62,386 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)