The Telegram Alien ULP P795 Log Appeared on the Dark Web in March

HEROIC analysts identified a stealer log circulating on Telegram on March 11, 2025, distributed through a public channel under the name TXTLOG_ALIEN - 795. The log contained aproximately 40.8 million lines of harvested credential data, exposing 8,649,286 unique email addresses alongside plaintext passwords and homepage URLs. This type of leak is rarely the result of a single company being hacked. Instead, it is a bulk collection of credentials quietly stolen from ordinary users across many websites over an extended period.

Why This Stealer Log Is Particularly Dangerous

Plaintext passwords are the most dangerous form of leaked credential. Unlike hashed passwords, which require cracking before they can be used, plaintext passwords are immediately usable. An attacker who obtains your email address and password in this format can log into your accounts within seconds. Because most people reuse passwords across multiple services, a single leaked pair can open doors to banking apps, email inboxes, social media, and workplace accounts all at once. The presense of homepage URLs in this dataset also tells attackers exactly which websites these credentials belong to, making targeted attacks even easier to launch.

What Was Exposed in the Telegram alien ULP P795 Breach

• Email addresses (8,649,286 unique records)
• Plaintext passwords
• Homepage URLs associated with each credential pair

Why This Matters for Your Online Security

Credential stuffing is the first weapon attackers reach for after a dump like this surfaces. Automated tools run thousands of login attempts per minute using stolen email and password combinations, targeting banks, streaming platforms, email providers, and retail accounts. If your credentials appear in this log and you use the same password elsewhere, you are at elevated risk of account takeover. Beyond that, access to your email inbox can allow an attacker to reset passwords on every other account you own, turning one compromised credential into a full identity takeover. Financial fraud and unauthorized purchases are common downstream effects that victems often discover weeks or months after the initial breach.

How Stealer Logs Work

A stealer log is created by a category of malware known as an infostealer. These programs silently infect computers, often through phishing emails, malicious downloads, or fake software updates. Once installed, the malware scans the infected device for saved passwords stored in browsers like Chrome or Firefox, login sessions, autofill data, and cookies. All of this data is packaged into a log file and sent back to the attacker. Infostealers are sold on underground forums as a service, meaning anyone with a small budget can run their own credential harvesting operation. The resulting logs are then compiled and distributed on platforms like Telegram, where they are shared freely or sold in bulk. The Telegram alien ULP P795 log is one such compilation, aggregating stolen credentials from an untold number of infected devices across the United States and beyond.

Check If You Are Affected by This Breach

HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including stealer logs like this one. If your credentials appeared in the Telegram alien ULP P795 dataset or any other known breach, you will see it immediately. Enter your email at HEROIC.com to run a free scan and find out whether your information is currently in the hands of threat actors.