Telegram alien ULP P800 Leak Spills 9.19 Million Logins

HEROIC indexed 9,194,649 unique records from the Telegram alien ULP P800 by alien leak on March 13, 2025. Labeled TXTLOG_ALIEN - 800, the file entered a Telegram distribution channel as part of a 57.8 million line URL:LOGIN:PASS bundle, kicking off the P800 series from the alien operator.

Why This Stealer Log Is Dangerous

Being the first numbered release in a new batch, P800 establishes the baseline for the follow-on P801, P802, P803, and P804 drops. Credential buyers and credential stuffers treat the whole series as a single dataset, which means one infected machine can appear in multiple releases and be exploited by different actors in parallel.

What Was Exposed in the Telegram alien ULP P800

• 9,194,649 unique email addresses
• Plaintext passwords straight from browser storage
• Homepage URLs mapping each credential to its service
• Active login pairs targeting US banking, retail, and SaaS

Why This Matters

URL:LOGIN:PASS files remove every hurdle for attackers. A stuffing tool can iterate through millions of entries and immediately attempt logins at the exact services where the passwords were captured. The fallout includes account takeover, crypto wallet drains, fraudulent online purchases, and compromised workplace email.

How a Stealer Log Dump Works

Infostealers such as RedLine, Vidar, Lumma, and StealC reach victims via cracked software, malicious ads, and phishing links. When executed they harvest browser-saved passwords, cookies, autofill data, and crypto wallets, then ship the haul to a collector. The actor alien packages victim logs into numbered ULP parts and distributes them through Telegram and BreachForums, feeding the credential stuffing economy.

Check If You Are Affected

Rotate browser-stored passwords, enable multi-factor authentication across banking, email, and workplace tools, and run a trusted antivirus scan to clean out active infostealer malware. Use the HEROIC scanner, tracking more than 400 billion breached records, to check whether your email appears in the Telegram alien ULP P800 drop.