2.7M VIP_ULP Records: Email & Plaintext Passwords

In February 2026, a stealer malware attack on VIP_ULP FREE compromised 2,759,598 user records, making this one of the largest credential theft incidents of the year. The threat actor uploaded the complete dataset to Telegram, openly distributing plaintext passwords, email addresses, and API infrastructure details to anyone in the underground community.

Why This Is Dangerous

This breach exposes three critical attack surfaces at once: valid email addresses for phishing campaigns, plaintext passwords for immediate account access, and API URLs that reveal the platform's technical architecture. Attackers can use the email addresses to launch targeted credential stuffing attacks across financial, email, and social media accounts where users likely reused the same password.

What Was Exposed

• Email addresses for 2,759,598 active VIP_ULP users
• Plaintext passwords with no encryption or hashing
• API endpoint URLs and internal service architecture
• System configuration data and authentication tokens

Why This Matters

The scale of this breach transforms it from a security incident into a mass exploitation opportunity. With nearly 2.8 million valid email-password pairs, attackers can automate account takeovers at scale. They can rent out access bundles to other criminals, use the stolen credentials for insider attacks, or resell the database on underground forums. The plaintext nature means no computational effort required—attackers simply log in.

How Stealer Malware Operates

Stealer malware harvests credentials by monitoring what users type, intercepting browser autofill data, and exfiltrating saved passwords from browser storage. Unlike traditional database breaches where passwords are hashed server-side, stealers extract credentials before they're stored securely. This means everything captured is immediately actionable—no cracking, no decryption delays. The malware typically spreads through trojanized downloads, phishing links, or supply-chain compromises, giving attackers time to exfiltrate massive datasets before detection.

Check If You're Affected

If you used VIP_ULP FREE before February 2026, change your password now on all platforms where you might have reused the same credentials. Check your email for unauthorized login attempts or account recovery notices. Enable two-factor authentification on financial and email accounts immediately.