The Telegram Alien ULP P743 Leak Contains More Stolen Logins Than the Population of Ohio

HEROIC analysts confirmed a stealer log distribution event on February 12, 2025, originating from a Telegram channel operated by a threat actor known as "alien." The log, catalogued as TXTLOG_ALIEN - 743, was part of an ongoing series of credential dumps published through the same channel in rapid succession. This particular release comprised roughly 50 million lines of raw data. After deduplication, analysts identified 10,891,739 unique email addresses, each paired with a plaintext password and a homepage URL pinpointing the site from which the credential was stolen. This is not a historical breach of a single organization. It is a freshly compiled harvest of real account credentials taken from infected devices around the world.

Why Plaintext Passwords in a Public Telegram Channel Are Immediately Dangerous

There is no decryption step required here. The passwords in TXTLOG_ALIEN - 743 are readable by anyone who opens the file. That means the moment this log hit the Telegram channel, every subscriber had functional login credentials for 10.8 million accounts. Automated attack tools can cycle through those credential pairs at thousands of attempts per minute, testing them against email providers, banks, and shopping platforms. By the time most victims learn their password was exposed, multiple login attempts may already have been made.

What Was Exposed in the Telegram Alien ULP P743 Dump

• Email addresses (10,891,739 unique accounts confirmed)
• Plaintext passwords (no cracking required, directly actionable)
• Homepage URLs (identifying exactly which website each credential belongs to)

Why This Matters for Credential Stuffing and Account Takeover

The ULP format used in this dump, where each line contains a URL, a login, and a password, is designed for direct use in credential stuffing tools. Attackers do not need to sort or interpret the data. They can load it straight into an attack framework and begin testing. Homepage URLs tell attackers which platform to target for each credential, making their campaigns more efficient and more likely to succeed. Victims who reuse passwords across multiple accounts face a chain reaction: one compromised credential can lead to takeover on email, banking, healthcare portals, and workplace systems simultaneously.

How Stealer Log Breaches Work

A stealer log is not a single corporate breach. It is an aggregation of data stolen from thousands of individual infected computers. Infostealer malware, distributed through pirated games, cracked software, or phishing links, runs quietly on a victim's device. It scans the browser for saved passwords, records open tabs, and captures session tokens. Every piece of stolen data is sent back to the attacker, who compiles contributions from thousands of infected machines into one massive log file. The resulting dump, published under a name like TXTLOG_ALIEN - 743, reflects infections across many countries and services, not a single company's database being hacked.

Check If Your Email Was Caught in the Alien ULP P743 Leak

HEROIC maintains a breach database covering more than 400 billion exposed records, including stealer log series distributed through Telegram. A free scan of your email address takes seconds and will tell you immediately whether your credentials appear in this dump or any other breach in the database. If you are exposed, you will know which accounts to secure first. Run your free check at heroic.com.