Who Was Hit by the Telegram alien ULP P854 Stealer Dump

HEROIC found 13,464,517 unique records in the Telegram alien ULP P854 by alien leak on March 18, 2025, exposing email addresses, plaintext passwords, and homepage URLs pulled from stealer malware logs. The file was distributed in a Telegram channel as TXT_ALIEN - 854 and contained roughly 64.3 million total lines of credential material.

Why This Stealer Log Is Dangerous

Stealer log victims span gamers, small business owners, remote workers, students, and corporate administrators because the malware infects endpoints indiscriminately. Every record in P854 gives attackers a working login to the exact site a victim used, no guessing required. That makes this dump one of the fastest routes from a single infection to widespread account takeover.

What Was Exposed in the Telegram alien ULP P854

• 13,464,517 unique email addresses
• Plaintext passwords captured in real time
• Homepage URLs that pinpoint each login site
• URL:LOGIN:PASS triples formatted for automated stuffing

Why This Matters

Plaintext password pairs power credential stuffing, account takeover, identity theft, and financial fraud with no hash cracking required. Because the URLs reveal banking portals, crypto exchanges, cloud storage, and corporate SSO, initial access brokers buy these logs to sell footholds to ransomware affiliates. One reused password can chain into email hijack, wire transfer fraud, and full-scale identity compromise.

How a Stealer Log Dump Works

Infostealers such as RedLine, Lumma, Vidar, and StealC spread through cracked software, malicious ads, and phishing lures. Once active on a device, they harvest saved browser passwords, cookies, autofill, and crypto wallet files, then ship the data to an operator. Operators bundle thousands of victim logs into large ULP files and drop them in Telegram channels, where resellers like alien package and distribute them to other criminals.

Check If You Are Affected

Rotate passwords saved in your browser, enable multi-factor authentication on banking, email, and work accounts, and scan your device for infostealer activity. You can search the HEROIC scanner, which tracks more than 400 billion breached records, to see whether your email appears in the Telegram alien ULP P854 or any related stealer log dump.