The MaitreCloud 3.5M ULP Quietly Appeared on BreachForums in November
On November 22, 2024, a stealer log titled "3.5M PRIVATE ULP | 22.11.24 | Maitre Cloud" was quietly posted to BreachForums by a threat actor operating under the name MaitreSearch. The post received little mainstream attention, but it contained 1,406,111 unique email addresses paired with plaintext passwords and homepage URLs -- credentials harvested by information-stealing malware and compiled into a format ready for automated account takeover campaigns.
This is part of a recurring series of credential dumps by MaitreSearch on BreachForums. See also: BreachForums MaitreCloud 5M ULP 12/13-14/24 by MaitreSearch -- a follow-up drop exposing an additional 1.63 million credentials in December 2024.
Why This Is Dangerous
Stealer logs containing plaintext passwords represent the highest-severity credential exposure possible. Unlike hashed passwords that require cracking, these passwords are immediately usable. Combined with the matched homepage URL -- which tells attackers exactly which site the password belongs to -- this data functions as a ready-to-deploy attack toolkit for anyone who downloads it.
What Was Exposed
- 1,406,111 unique email addresses -- verified, active accounts from real users
- Plaintext passwords -- immediately usable without any cracking step
- Homepage URLs -- site-specific context telling attackers exactly where each password was used
Why This Matters
Plaintext credential logs like this one fuel several attack chains simultaneously:
- Credential stuffing: Automated bots test each email-password pair across hundreds of popular sites within hours of a dump going public.
- Account takeover: Successful logins on email providers give attackers access to password reset flows for banking, shopping, and social accounts.
- Identity theft: Verified email-password pairs combined with the associated site context allow attackers to quickly build detailed profiles on victims.
- Fraud: Access to financial or e-commerce accounts enables immediate unauthorized transactions.
How Stealer Logs Work
Stealer logs are produced by information-stealing malware -- programs like RedLine, Vidar, or Raccoon Stealer -- that infect a victim's device and silently harvest saved browser credentials, session cookies, and autofill data. The stolen data is sent to an attacker-controlled server, compiled into a ULP (URL-Login-Password) format, and sold or posted to forums like BreachForums. A single stealer infection can expose credentials for dozens of websites simultaneously.
Check If You Are Affected
If your email or password appears in this MaitreCloud dump, attackers may already have tried it against your accounts. HEROIC monitors 400 billion+ breached records. Run a free scan now to check your exposure across this and every other known breach.
Search the HEROIC Database -- Free Scan
Related Parts
Breach Breakdown
1,406,111 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)