Someone Has Your Password: 1,132,488 Credentials Leaked

HEROIC's threat intelligence team discovered a massive stealer log collection labeled ULP GOOD BY MOON_SUPP1_000003 being distributed via Telegram. Dated May 2025, this dump contains a staggering 1,132,488 records stolen from infected devices, including email addresses, plaintext passwords, and the URLs of websites where those credentials were used.

Plaintext Passwords: Zero Barrier to Account Takeover

Every password in this collection is stored in plaintext, meaning they appear exactly as the user originally entered them. There is no hashing, no encryption, and no additional step required for an attacker to use them. With 1,132,488 ready-to-use credentials, cybercriminals can begin testing logins within seconds of downloading this file. The sheer scale of this dump dramatically increases the odds that your credentials are included.

What Was Exposed

• Email Addresses — login identifiers for personal, corporate, and service accounts
• Plaintext Passwords — fully readable, unencrypted passwords
• URLs — the websites and platforms where each credential was captured

Why One Leaked Password Can Compromise Many Accounts

Credential stuffing attacks exploit the common habit of password reuse. When attackers get hold of over a million email-password pairs like those in this dump, they run automated scripts against banking portals, email providers, e-commerce sites, and social media platforms. A single matching password can open the door to financial fraud, identity theft, and unauthorized access to sensitive personal data across your entire digital life.

Understanding Stealer Log Malware

This breach originated from infostealer malware infections across potentially thousands of devices. Programs such as RedLine, Raccoon, and Lumma silently install themselves through deceptive downloads, cracked software, or phishing links. Once active, they scrape login credentials stored in web browsers, capture active session cookies, and harvest autofill data. The stolen information is compiled into structured log files and distributed to threat actors through underground markets and Telegram channels.

Check If Your Credentials Were Exposed

With over 400 billion records in its breach intelligence database, HEROIC offers one of the most comprehensive tools available for detecting compromised credentials. Search for your email address using HEROIC's breach scanner to find out if your data appears in the ULP GOOD BY MOON_SUPP1_000003 dump or any other known leak. If a match is found, immediately update your passwords and activate two-factor authentication wherever possible.