One Telegram File. 52.5 Million Lines. 8.2M Unique P728 Logins.

HEROIC analysts tracked the Telegram alien ULP P728 release on February 4, 2025, a single file posted to a Telegram channel under the name TXTLOG_ALIEN - 728. The file contains 52.5 million lines and resolves to 8,263,099 unique records, each with an email address, plaintext password, and the homepage URL where the credential was captured.

Why This Stealer Log Is Dangerous

One file, over eight million validated credentials, zero friction for the attacker. The plaintext format removes any cracking requirement, and the captured URL removes any guessing about which service the password unlocks. Everything needed for credential stuffing is in a single download.

What Was Exposed in Telegram alien ULP P728

• Email addresses pulled from infected browsers
• Plaintext passwords exactly as the user typed them
• HomePage URLs that label the target service

Why This Matters

8.2 million pre-validated credentials drive immediate credential stuffing, account takeover against banks and webmail, identity theft when combined with PII from other dumps, and ongoing fraud across shopping, crypto, and gaming accounts. Reused passwords multiply the damage per victim.

How Stealer Logs Work

Infostealer malware scrapes saved credentials and cookies from infected browsers and sends the data home to the operator. Operators package thousands of machine logs into ULP (URL, Login, Password) files and publish them on recurring Telegram channels with versioned monikers like alien P727, P728, P735, and P736.

Check If You Are Affected

Check your email against HEROIC's database of more than 400 billion exposed records to see whether you appear in P728 or any other alien drop from the same operator.