Why Credential Crews Paid for the Telegram ULP P765 Drop of 15.1M Logins

HEROIC found 15,116,454 records in Telegram alien ULP P765 by alien on 23-Feb-2025, exposing email addresses, HomePage URLs, and plaintext passwords pulled from a 62.2 million line infostealer log.

Why Attackers Move Fast on Telegram alien ULP P765

Credential stuffing crews have a shopping list, and Telegram alien ULP P765 is exactly what they wait for. The drop hit the alien Telegram channel on February 23, 2025, delivered as the file TXTLOG_ULP_ALIEN - 765. From the attacker's perspective, this is ready to use ammunition. The file is large, it is already cleaned, and it ships with the URL column that makes targeting trivial.

The operators of credential stuffing infrastructure keep automation pointed at channels like this one. New drop arrives, downloads start within minutes, and jobs run through the night against hundreds of high value login endpoints. From the receipt of the file to the first successful account takeover, the gap can be measured in hours.

What Was Exposed in Telegram alien ULP P765 by alien

• 15,116,454 unique records extracted from a 62.2 million line stealer log
• Email addresses that serve as usernames for thousands of services
• Plaintext passwords stolen from victim browsers, ready to replay
• HomePage URLs telling the attacker which site each credential was last used on
• Pushed through the alien ULP P765 Telegram channel by the handle alien

Why This Matters

Here is what an attacker does with a drop like P765. They split the file by the URL column. They pull the rows that point to Microsoft 365, Google, banking sites, crypto exchanges, and streaming services. They load each chunk into a tool such as OpenBullet or SilverBullet with the matching config. Then they test. For accounts where the user has not rotated passwords, the tool prints a success line. That is the single point where the breach becomes someone's personal crisis.

From a corporate defender's angle, the takeaway is that employees whose personal devices are infected by stealers become corporate risks within a single drop cycle. If your workforce uses the same password for personal Gmail and work Outlook, a single machine infection can end up inside a Telegram ULP file that is used to test against corporate SSO later the same week.

How Alien Builds Each Telegram Drop

Alien is a repeat operator. The P in P765 indicates a sequence number, and the channel pushes out new drops on a steady cadence. The feedstock is the output of infostealer families running on compromised endpoints worldwide, including RedLine, Lumma, StealC, and Vidar. That output is cleaned, deduplicated against prior drops, numbered, and pushed into the channel. The scale of 62.2 million raw lines per drop shows how many infected devices feed the pipeline.

This is not a one off leak. P765 will be followed by P766, P767, and beyond, each with fresh credentials harvested in the days between drops.

Check If You Are Affected

HEROIC ingests alien series Telegram drops into a monitoring system covering 400 billion compromised records. A single free HEROIC scan checks your email, known passwords, and URL pairings against the alien ULP P765 file and the surrounding ecosystem of infostealer leaks. Scan now and rotate any password that comes back as exposed before a credential stuffing tool gets to it first.