Infostealer Fallout: Telegram ULP P779 Dumps 13.5M Plaintext Logins

HEROIC processed 13,567,279 unique records from the Telegram alien ULP P779 by alien stealer log dropped on March 3, 2025, exposing email addresses, homepage URLs, and plaintext passwords pulled straight off infected victim machines. The dump was distributed through a Telegram channel favored by the infostealer scene, making it instantly available to every low-tier account takeover crew watching that feed.

Why This Telegram ULP P779 Stealer Log Is Dangerous

This is not a hashed database export, it is raw browser-stored credentials harvested by malware. Every line is a working email, password, and the exact site where it logged in. Attackers do not need to crack anything. They can replay the pairs against banks, email providers, crypto exchanges, and SaaS tools the moment they copy the file.

What Was Exposed in Telegram alien ULP P779 by alien

• 13,567,279 unique email addresses harvested from infected devices
• Plaintext passwords captured by infostealer malware
• Homepage URLs identifying the exact login targets for each credential
• Approximately 55 million total credential lines before deduplication

Why This Matters

The infostealer industry has industrialized credential theft. Logs like ULP P779 are scraped from Redline, Raccoon, Lumma, and similar stealers, then packaged and redistributed for anyone to grab. That means any account on an infected machine is exposed, even if the host service itself was never breached. Enterprise SSO portals, VPN logins, and admin panels are routinely harvested this way.

How an Infostealer Log Like This Works

A victim installs a cracked application, a malicious browser extension, or a phishing payload. The stealer silently harvests saved browser passwords, cookies, autofill data, and session tokens, then exfiltrates everything to an attacker-run Telegram bot. Operators bundle the logs into pack files like TXTLOG_ALIEN 779 and share them to build reputation or sell access. ULP P779 is one such bundle, now public and searchable.

Check If You Are Affected

If any device you use could have seen malware in the last year, run your email through HEROIC's 400B+ compromised record database to see if your credentials show up in the Telegram alien ULP P779 log. Finding a match means rotating every password you have saved in that browser and scanning for persistent infostealer malware.