Researchers Link the TXTLOG_ALIEN – 702 Dump to 12 Million Stolen Credentials Leaked on Telegram

Researchers tracking the ALIEN stealer log campaign identified the TXTLOG_ALIEN - 702 file on a Telegram channel on January 21, 2025. The log contained approximately 43 million total records, from which 12,167,088 unique email addresses were extracted. Each record in the dataset includes an email address, a corresponding plaintext password, and a homepage URL that identifies which website the credential was stolen from. The file was posted openly on Telegram, putting it in reach of anyone monitoring the channel at the time of distribution.

Why Researchers Consider This Log a High-Risk Credential Source

Researchers flag stealer logs as particularly dangerous when they combine three elements: a large unique record count, plaintext password storage, and open distribution. TXTLOG_ALIEN - 702 meets all three criteria. With 12 million unique email and password pairs available in readable form and distributed through Telegram rather than a gated dark web forum, the barrier for exploitation is essentially zero. The homepage URLs add another layer of value for attackers, effectively providing a sorted list of which credentials go with which websites, reducing the guesswork in credential stuffing campaigns.

What Was Exposed in the TXTLOG_ALIEN - 702 Log

• Email addresses (approximately 12 million unique)
• Plaintext passwords matched to each email address
• Homepage URLs identifying the sites where credentials were captured by malware

Why This Matters: From Stolen Credentials to Compromised Accounts Across the Web

When researchers study account takeover patterns, they consistently trace them back to stealer log data. The combination of email and plaintext password is the most efficient attack resource available because it requires no additional processing. Attackers load these pairs into automated tools and run them against every major platform: email, banking, social media, ecommerce, and corporate systems. Password reuse means a single compromised credential often unlocks multiple accounts. Researchers have documented cases where a single stealer log entry led to financial fraud, identity theft, and corporate network intrusion when the affected person reused their password at work.

How the ALIEN Series Became One of the Most Prolific Stealer Log Campaigns

Researchers tracking the ALIEN series note its hallmarks: sequential numbering, consistent data structure, and Telegram as the primary distribution method. The underlying malware targets saved browser credentials, form autofill data, and session tokens. Victims typically encounter it through malicious downloads, pirated software, or phishing emails. The operator has maintained a high release cadence, with dozens of batches distributed in January 2025 alone. TXTLOG_ALIEN - 702 is one entry in an ongoing series that researchers estimate has collectively exposed hundreds of millions of credential records.

Check If Your Data Appeared in the TXTLOG_ALIEN - 702 Log

HEROIC's breach scanner indexes more than 400 billion compromised records, including stealer logs from Telegram and other distribution channels. If your email address appeared in TXTLOG_ALIEN - 702, a free scan at HEROIC will show it. Enter your email, see exactly which breaches have touched your data, and get clear steps to protect yourself before attackers act on what they already have.