The ULP BY MOON_SUPP1 Dump Gave Hackers 2.5 Million Logins

HEROIC analysts identified another massive stealer log dataset, this one named "ULP BY MOON_SUPP1_000003," uploaded to a Telegram channel on June 20, 2025. The file contains 2,560,994 records combining email addresses, plaintext passwords, and the exact URLs of the websites those credentials belong to, making it one of the largest single logs HEROIC has tracked from this uploader.

Why This Is Dangerous

The "SUPP1" label suggests this file is a supplemental batch, an additional round of stolen credentials released alongside earlier dumps from the same source. With 2.5 million plaintext entries, each already matched to its login page, an attacker has essentially been handed a working key to millions of accounts without needing to crack a single password.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

At this scale, the risk extends well beyond any single website. Because the passwords are plaintext and tied to specific login pages, attackers can move through the file attempting account takeover across banking, email, and social media services wherever people reused credentials. A file this large also makes automated credential stuffing highly efficient, since bots can test millions of email and password combinations against popular sites in minutes.

How Stealer Logs Work

Stealer logs are generated by infostealer malware that infects a device through sources like pirated software, phishing emails, or malicious ads, then silently extracts saved passwords, autofill entries, and active browser sessions. Criminals frequently combine the output of thousands of individual infections into one large file and release it in batches, exactly what the "SUPP1" naming suggests happened here, before distributing it through Telegram to buyers looking for fresh, large-scale credential dumps.

Check If You Are Affected

With 2.5 million accounts caught up in this single leak, the odds that your email is among them are real. HEROIC's free breach scanner searches a database of more than 400 billion exposed records to give you an instant answer and clear steps to secure your accounts if you're affected.