U.S. Accounts Dominate the P723 Stealer Log: 11.3M Compromised

HEROIC Cybersecurity analysts recovered 11,295,723 unique accounts, heavily weighted toward United States services, from the Telegram alien ULP P723 by alien stealer log distributed on February 2, 2025. The archive, titled TXTLOG_ALIEN - 723, contained roughly 62.5 million lines of URL, email, and plaintext password triples harvested from infected devices.

Why This Stealer Log Is Dangerous

The log is concentrated on U.S. services, which means the credentials target heavily regulated sectors like banking, healthcare, and payroll where account takeover translates directly into financial loss. Every line pairs the exact login URL with an email and plaintext password, so an attacker does not have to guess what to try, the log tells them.

What Was Exposed in Telegram alien ULP P723 by alien

• 11,295,723 unique email addresses
• Plaintext passwords tied to each address
• Homepage URLs identifying the exact login target for each credential
• Approximately 62.5 million total lines of stealer log data

Why This Matters

Plaintext credentials feed credential stuffing the minute they are public. For U.S. victims that typically means banks, 401k providers, telecom logins, and email, all of which feed account takeover, identity theft, and tax refund fraud. Reused passwords let one compromised account cascade into every linked service.

How the Alien Release Chain Works

The alien distributor publishes numbered stealer log bundles (P722, P723, P724) on Telegram every few days. Each bundle aggregates infostealer output from malware like RedLine, Raccoon, and Lumma delivered through cracked software, fake installers, or malicious ads. The steady numbering is a sign of an ongoing harvesting pipeline, not a single incident.

Check If You Are Affected

HEROIC's DarkHive scanner indexes more than 400 billion exposed records, including the full P723 dataset. Search your email to see if your credentials appeared, rotate any reused passwords immediately, and enable multi-factor authentication on email, banking, and cloud accounts.