11,771,443 Accounts Recovered From the P725 Stealer Log

HEROIC Cybersecurity analysts recovered 11,771,443 unique accounts from the Telegram alien ULP P725 by alien stealer log, distributed on February 3, 2025. The dataset surfaced through a Telegram channel as a raw log file designated TXTLOG_ALIEN - 725 and contained approximately 56.2 million lines of harvested credentials. Each recovered record pairs an email address with a plaintext password and the homepage URL where the victim used that credential.

Why This Stealer Log Is Dangerous

Stealer logs are the raw output of infostealer malware installed on a victim's own machine. Unlike a traditional database breach, the attacker already had direct browser access when the credentials were stolen, which means session cookies, autofill entries, and saved logins were captured together. The P725 log lists each victim alongside the exact site they were trying to log into, giving any buyer a ready-made map of which services to try first.

What Was Exposed in Telegram alien ULP P725 by alien

• 11,771,443 unique email addresses
• Plaintext passwords tied directly to those addresses
• Homepage URLs indicating the target site for each credential pair
• Approximately 56.2 million total lines of harvested data

Why This Matters

Because the passwords arrived in plaintext, attackers can load them into credential stuffing tools the same day. Any victim who reused a password across banking, email, or retail accounts is exposed to immediate account takeover. Email addresses are also ideal raw material for targeted phishing, identity theft, and tax or benefits fraud, especially when paired with the specific sites a victim is known to use.

How Stealer Log Distribution Works

Infostealer malware, often delivered through cracked software, fake installers, or malicious ads, scrapes saved browser credentials and transmits them back to an operator. That operator compiles the collected logs into batches, numbers them sequentially (P724, P725, P726), and drops the archives into Telegram channels where buyers subscribe for access. The numbered naming convention on P725 is a strong signal that this is one release in an ongoing operation rather than an isolated incident.

Check If You Are Affected

HEROIC's DarkHive scanner searches more than 400 billion exposed records, including every email in the P725 log. Run your address through the scanner to see if your credentials were captured, then rotate any reused passwords and enable multi-factor authentication where possible.