Our Analysts Found the TXTLOG_ALIEN – 783 Dump With 13 Million Stolen Logins on Telegram

HEROIC analysts found the TXTLOG_ALIEN - 783 credential dump circulating in a public Telegram channel on March 5, 2025. The package contained approximately 55.9 million lines of raw data, resolving to 13.09 million unique email addresses after deduplication. Every record included a plaintext password and a homepage URL identifying the site where credentials were captured. The data reached criminal networks within hours of being posted.

Why Plaintext Passwords in This Log Create Immediate Risk

Every password in TXTLOG_ALIEN - 783 is fully readable. No cracking tools are required. Attackers who downloaded this file can test credentials against major platforms immediately using basic automation scripts. The homepage URLs narrow the attack further, letting criminals target the exact sites where each credential was stolen before branching into other accounts where the same password was reused.

What Was Exposed in the TXTLOG_ALIEN - 783 Dump

• Email addresses (13.09 million unique entries)
• Plaintext passwords (readable with no decryption)
• HomePage URLs (identifies which site each credential came from)

Why This Matters for Over 13 Million People

Credential stuffing is the primary threat at this scale. Automated tools test millions of email-password pairs across dozens of platforms at once. A successful match gives attackers full account access. They lock out the original owner by changing recovery details, then drain financial resources or sell the access to other criminals.

An email account that falls under attacker control becomes a master key. From a compromised inbox, criminals can reset passwords on banking apps, utility accounts, government portals, and every service tied to that address.

How the ALIEN Telegram Log Series Operates

These logs are produced by infostealer malware that silently harvests credentials saved in browsers and apps on infected devices. Captured data is aggregated, deduplicated, and packaged into numbered batches. The ALIEN series is sequential, with P783 being the 783rd package in an ongoing, professionalized campaign. Each batch is published to a Telegram channel open to the entire criminal subscriber base at no cost.

Our Analysts Found the TXTLOG_ALIEN - 783 Dump Circulating in a Public Telegram Channel

HEROIC's dark web monitoring team identified this package on March 5, 2025, through continuous surveillance of credential distribution channels. The dump was publicly accessible to any Telegram user, meaning a very large number of threat actors obtained a copy on the day of release.

HEROIC's breach scanner checks your email against more than 400 billion compromised records, including this dump. Visit HEROIC.com to run a free scan in seconds. If your data is found, change the affected password immediately, avoid reusing it on other accounts, and turn on two-factor authentication wherever you can.