No Headlines, Just 12.4 Million Emails in the P720 Leak

HEROIC Cybersecurity analysts recovered 12,474,095 unique accounts from the Telegram alien ULP P720 by alien stealer log, distributed on January 31, 2025. The archive, titled TXTLOG_ALIEN - 720, contained roughly 53.4 million lines of URL, email, and plaintext password data harvested from infostealer infections across many personal devices.

Why This Stealer Log Is Dangerous

The P720 drop did not make headlines, yet it leaked more credentials in one file than most named corporate breaches combined. Every line links a login URL to an email and the exact plaintext password saved in the victim's browser, so attackers can start credential stuffing within minutes of downloading the archive.

What Was Exposed in Telegram alien ULP P720 by alien

• 12,474,095 unique email addresses
• Plaintext passwords tied to each address
• Homepage URLs identifying the exact login target for each credential
• Approximately 53.4 million total lines of stealer log data

Why This Matters

Plaintext credentials are the most dangerous form of password leak because there is nothing left to crack. Victims face immediate account takeover anywhere the password is reused, and the attached email addresses fuel identity theft, targeted phishing, and fraudulent account recovery attempts. Because the log is organized by URL, attackers can also sort and prioritize valuable targets such as banks and webmail providers.

How Stealer Logs Flow From Infection to Telegram

An infostealer like RedLine, Raccoon, or Lumma sneaks onto a device through cracked software, pirated games, fake installers, or malicious ads. Once installed, it scrapes saved browser credentials, autofill entries, and cookies, then sends them to an operator. The operator bundles the output from many infections into numbered releases (P719, P720, P721) and publishes each one on Telegram channels where subscribers download the archives.

Check If You Are Affected

HEROIC's DarkHive scanner indexes more than 400 billion exposed records, including the full P720 dataset. Search your email to see if your credentials appeared, rotate any reused passwords, and enable multi-factor authentication on email, banking, and cloud accounts.