Breaking: Telegram ULP P763 Dumps 13.4M Logins From One Stealer Log

HEROIC found 13,406,314 records in Telegram alien ULP P763 by alien on 22-Feb-2025, exposing email addresses, HomePage URLs, and plaintext passwords pulled from a 57.6 million line infostealer log.

Why This Telegram alien ULP P763 Release Is Dangerous

On February 22, 2025 a new entry hit the alien Telegram channel. The file, labeled TXTLOG_ALIEN - 763, carried 57.6 million raw lines of stolen login data. After deduplication, 13,406,314 records remain as unique, clean, and ready for credential stuffing tools. Every row pairs an email, a plaintext password, and the exact URL the password was last used on.

The headline here is not the operator or the channel, it is the speed. A ULP drop of this size becomes active ammunition inside credential stuffing workflows within hours of release. By the time news coverage catches up, the file has already been run against thousands of login endpoints worldwide.

What Was Exposed in Telegram alien ULP P763 by alien

• 13,406,314 unique records extracted from 57.6 million stealer log lines
• Email addresses used as account logins across a wide spread of services
• Plaintext passwords captured directly from victim browsers
• HomePage URLs identifying exactly which site each credential unlocks
• Released through the alien ULP P763 Telegram channel by the operator alien

Why This Matters

A drop like P763 lands outside normal news cycles. There is no single compromised brand to name in a headline, which means mainstream coverage is minimal. That is part of why these leaks are so effective for attackers. The absence of press coverage means most of the 13.4 million people in the file never learn they are inside it. No password resets, no bank alerts, no training sessions, just quietly exposed credentials waiting to be used.

The URL column changes the calculus for defenders too. A login dataset without URLs is a blunt tool. A login dataset with URLs is a precision one. Attackers can pre sort by site and focus energy on the platforms that pay off fastest, including banking, crypto exchanges, corporate email, and cloud admin panels.

How Alien Telegram Drops Keep Producing At This Cadence

The alien operator runs a numbered Telegram channel that drops ULP files on a steady schedule. P763 follows P762 and precedes P764, all released within days of each other. Behind the scenes, infostealer families such as RedLine, Lumma, StealC, and Vidar are extracting saved browser passwords from compromised devices worldwide. That output is cleaned, deduplicated, numbered, and pushed to subscribers.

The scale is not an accident. It is the natural output of a long running malware as a service ecosystem. Until endpoint infections drop, the alien drops keep coming.

Check If You Are Affected

HEROIC monitors more than 400 billion compromised records including the alien ULP P763 dump. A single free HEROIC scan tells you whether your email, password fingerprint, or URL pairings appear in this file or in any of the related alien series leaks. Scan now and rotate anything that shows up, especially credentials tied to banking, crypto, corporate email, and identity services.