Credential Reuse Victims Hit by 8.7M Record Telegram Stealer Log

HEROIC analysts tracking illicit Telegram distribution channels confirmed the release of the Telegram alien ULP P735 stealer log on February 8, 2025, a dump containing roughly 38.1 million lines of harvested credentials. The file, titled TXTLOG_ALIEN - 735, exposed 8,732,967 unique records made up of email addresses, plaintext passwords, and the homepage URLs where each credential was captured.

Why This Stealer Log Is Dangerous

Unlike a single-site database breach, a stealer log is a live harvest from infected machines. Every record in this dump represents a working login someone actually typed into a browser, which means the pairing of email, password, and the exact site URL is already validated. Attackers do not need to guess which service the credentials belong to because the log tells them.

What Was Exposed in Telegram alien ULP P735

• Email addresses tied to active user sessions
• Plaintext passwords with no hashing or salting
• Homepage URLs identifying the targeted service

Why This Matters

Plaintext credentials fuel credential stuffing at industrial scale. Within hours of a log hitting Telegram, bots replay the pairs against banking portals, email providers, cloud consoles, and shopping accounts. Successful hits cascade into account takeover, identity theft, wire fraud, and SIM swap attempts. Anyone reusing the leaked password across services faces compounding risk.

How Database Leaks Work

Stealer malware quietly runs on a victim machine, extracts saved browser credentials and session cookies, and ships the haul to a command server. Operators then bundle thousands of victims into a single ULP (URL, Login, Password) file and post it to subscription Telegram channels. Buyers filter the log by domain to target specific industries or high-value accounts.

Check If You Are Affected

If you have reused passwords across multiple sites in the last several years, your credentials may already be circulating in logs like this one. Run a free scan against HEROIC's database of over 400 billion exposed records to see whether your email appears in this leak or any related dump.