Reporters Are Still Counting: Telegram ULP P771 Holds 11.6M Logins

HEROIC processed 11,660,661 unique records from the Telegram alien ULP P771 by alien stealer log released on February 26, 2025, exposing email addresses, plaintext passwords, and homepage URLs harvested off infected devices. Credential stuffing attempts tracked to this dataset appeared on authentication services within hours of the file going public on the alien Telegram channel.

Why This Telegram ULP P771 Stealer Log Is Dangerous

A stealer log with plaintext passwords is the worst shape a credential leak can take. There is no hashing to slow attackers down, and each line includes the exact URL the password was used on. ULP P771 is ready-to-use automation fodder for criminals running account takeover tools against banks, email providers, crypto exchanges, and enterprise SaaS tenants.

What Was Exposed in Telegram alien ULP P771 by alien

• 11,660,661 unique email addresses pulled from infected devices
• Plaintext passwords captured from browser credential stores
• Homepage URLs mapping each password to a specific login target
• Roughly 58.3 million raw credential lines in the source log

Why This Matters

Stealer logs like ULP P771 bridge the gap between a single infected laptop and a global account takeover campaign. They are indexed, searchable, and passed across Telegram channels for free, which means even small operators can log into the bank account of a specific victim in another country within minutes of the drop. Anyone whose browser saved passwords on an infected device is on the list.

How a Stealer Log Breach Like This Works

Infostealer malware like Redline, Lumma, Vidar, and Raccoon silently exfiltrates saved browser credentials, session cookies, and autofill data, then ships it to an attacker's Telegram bot. Operators bundle weeks of harvests into packs like ULP P771 and distribute them through alien's Telegram feed. The log travels faster than any breach notification could ever reach the victims.

Check If You Are Affected

If any device you use could have been infected in the last year, run your email through HEROIC's 400B+ record breach database to see whether the Telegram alien ULP P771 log exposes your credentials. A match means rotating every password saved in that browser and running a full malware scan before attackers beat you to it.