Quietly, FoxBaseWorld ULP-326 Exposed 235,842 Login Records

In June 2025, a Telegram user quietly uploaded a stealer log file known as UP_DAISYCLOUD - FOXBASEWORLD ULP-326, and inside it sat 235,842 records of real login data. No press release, no warning, just a file passed around in a channel until security researchers at HEROIC caught wind of it.

Why This Is Dangerous

Stealer logs like this one are dangerous precisely because they are quiet. There is no bank notifying you, no big headline. The data just sits there, ready for anyone who downloads the file to try it against email providers, banking portals, or work logins. This kind of quiet exposure has occured many times before, and it keeps happening as long as malware infections go unnoticed. If you happen to reuse a password across a few sites, one leaked credential can unlock several accounts at once.

What Was Exposed

• 235,842 total records
• Email addresses
• Plaintext passwords
• URLs tied to the accounts logged in on the infected machine

Why This Matters

Because the passwords in this dump are stored in plaintext, there is no decryption needed, no cracking involved. Anyone who grabs the file can literally read the password next to the email address and try it imediately. That kind of instant access is what makes this type of leak so appealing to low-effort attackers who just want a quick win.

How Stealer Logs Work

A stealer log is generated when malware infects a device, usually through a cracked game, a fake software installer, or a malicious email attachment. Once it's running, the malware quietly copies saved browser passwords, autofill data, and session cookies, then sends everything back to whoever controls it. That person then packages it up, like this FOXBASEWORLD ULP-326 file, and sells it or gives it away on Telegram.

Check If You Are Affected

You don't have to guess wich accounts might be exposed. HEROIC runs a free breach scanner that checks your email against a database of more than 400 billion compromised records, including logs like this one. It only takes a minute to check, and if something turns up, you can change the password before anyone else gets to it first.