Dark Web Intel on Telegram alien ULP P853: 16.1M Logins for Sale

HEROIC found 16,153,841 unique records in the Telegram alien ULP P853 by alien leak on March 18, 2025, exposing email addresses, plaintext passwords, and homepage URLs pulled from stealer malware logs. The dump arrived as TXT_ALIEN - 853 on a public Telegram channel, advertising roughly 62 million total lines of credential material.

Why This Stealer Log Is Dangerous

Dark web intel shows alien drops like P853 move fast. Within hours of release they are split, resold, and folded into combo lists used by credential stuffing crews, ransomware affiliates, and initial access brokers. Because each line couples a verified email with a plaintext password and the site it belongs to, buyers get instant account access with no cracking step required.

What Was Exposed in the Telegram alien ULP P853

• 16,153,841 unique email addresses
• Plaintext passwords captured from infected browsers
• Homepage URLs pointing to the originating login page
• URL:LOGIN:PASS triples ready for automation

Why This Matters

These records drive credential stuffing across banking, email, cloud, gaming, and corporate SSO. One reused password opens the door to account takeover, identity theft, crypto drain, and workplace compromise. Because the dump is free to download, even low-skill attackers run widespread abuse within days of release.

How a Stealer Log Dump Works

Infostealers such as RedLine, Vidar, Lumma, and StealC infect endpoints through cracked software, malvertising, and phishing attachments. On infection they read saved browser credentials, cookies, autofill data, and crypto wallets, then exfiltrate everything to a collector. Operators package logs into ULP files, number them sequentially, and push them through Telegram where alien and similar resellers keep a steady pipeline flowing.

Check If You Are Affected

Rotate browser-saved passwords, enable multi-factor authentication on banking and email, and scan your device for infostealer signs. You can search the HEROIC scanner, which tracks more than 400 billion breached records, to see whether your email appears in the Telegram alien ULP P853 or related dumps.