A ULP list is a collection of URL, login, password records assembled from stolen credentials, usually harvested by infostealer malware. The URL matters because it tells an attacker exactly where the credential should work, turning a stolen secret into near-ready access material.
What a ULP list is used for
A ULP list is not just a dump of stolen logins. It is a ready-to-use access map, because each record pairs a credential with the site or service it should unlock. That makes it more valuable to criminals than a raw password list, since they can target the right destination immediately and automate follow-on abuse.
In practice, ULP lists sit at the point where infostealer output becomes operationalised. The URL reveals the intended login surface, the username identifies the account, and the password or token can be tested with far less guesswork than a generic credential dump would require.
Why the URL field makes this more dangerous
The URL is what turns a credential into near-ready access material. Without it, an attacker has to guess which service the secret belongs to, and many stolen passwords are dead ends. With it, the attacker can prioritise high-value targets, separate useful records from noise, and move faster across consumer, business, and cloud services.
This is also why ULP lists are closely associated with credential stuffing, account takeover, and session abuse. A credential that works somewhere specific can be tested immediately, and if the account has weak password hygiene, reused credentials, or poor MFA coverage, the impact can spread beyond the original victim account.
How ULP lists are assembled and circulated
ULP lists usually come from infostealer malware that harvests browser-saved credentials, session data, and other authentication material from compromised endpoints. The resulting records are often normalised and sold, shared, or repackaged so other criminals can search by service, domain, or account value rather than by raw file content.
Because the list is structured, it supports industrial-scale abuse. Attackers can sort by domain, rank by target value, and reuse the same dataset across multiple fraud, intrusion, or resale workflows. That structure makes the list more efficient than a simple credential archive and helps explain why it remains commercially attractive in underground markets.
What defenders should infer from a ULP list exposure
A ULP list finding usually means the organisation should assume at least one endpoint has been compromised and that one or more accounts may already be exposed. The presence of a known URL tied to a valid login often indicates a concrete exposure path, not just a theoretical leak.
Defenders should treat the list as a clue about where to look first: affected services, reused passwords, active sessions, and any accounts with privileged or business-critical access. If the URL points to a SaaS portal, admin console, or remote access service, the downstream risk is often greater than the credential itself suggests.
For broader context on stolen credentials, endpoint harvesting, and the attacker’s use of identity material, see the NIST Cybersecurity Framework 2.0, the MITRE ATT&CK Enterprise Matrix, and the OWASP Non-Human Identity Top 10 where secret leakage and overprivilege become especially consequential.
Risk and Threat Considerations
ULP lists are dangerous because they compress discovery, targeting, and exploitation into one artefact. A stolen login tied to a specific URL can be turned into immediate access attempts, especially when attackers combine it with password reuse, session theft, or automated testing against common services.
Failure mechanism: Infostealer malware collects credentials from endpoints, normalises them into URL-linked records, and sells or reuses them so the attacker can move straight from theft to account testing, takeover, or resale.
Impact: The result can be account compromise, fraud, exposure of internal systems, lateral movement through trusted SaaS or admin portals, and higher-value compromise when the account has privileged or persistent access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1003 — OS Credential Dumping | ULP lists often originate from stolen credentials harvested from endpoints. |
| T1555 — Credentials from Password Stores | The term reflects credentials extracted from browser and local password stores. | |
| T1110 — Brute Force | URL-linked credentials are commonly tested in automated login abuse and stuffing. | |
| Recommendation — Map endpoint harvesting to T1003 and hunt for credential theft on compromised hosts. Inspect browser and local secret stores for abuse consistent with T1555. Correlate repeated login failures and automated attempts with T1110 activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | ULP exposure is often surfaced through detection of compromised endpoints or unusual access attempts. |
| PR.AA-05 — Access permissions, entitlements, and authorizations are managed in accordance with risk | A ULP list becomes more dangerous when exposed accounts retain excess access. | |
| Recommendation — Monitor endpoint and authentication telemetry for signs of credential theft and account abuse. Reduce standing access so exposed credentials do not map to broad privileges. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Stolen passwords and related secrets fall under authenticator lifecycle and protection controls. |
| Recommendation — Rotate and revoke exposed authenticators under IA-5 discipline. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | ULP lists are built from stolen secrets and credential material. |
| NHI-07 — Long-Lived Secrets | ULP records are most damaging when stolen secrets remain valid for extended periods. | |
| NHI-05 — Overprivileged NHI | When ULP records belong to service or machine accounts, excess privilege amplifies impact. | |
| Recommendation — Treat secret leakage as a reportable exposure and remove exposed material promptly. Shorten secret lifetime so stolen credentials expire before reuse. Reduce privilege on exposed non-human accounts to contain blast radius. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The term concerns stolen login credentials and the security of authentication journeys. |
| Recommendation — Apply phishing-resistant authentication and stronger identity assurance where exposed logins are in scope. | ||
Practitioner Guidance
Why practitioners should care: A ULP list is a strong signal that credential exposure is already actionable, not hypothetical. When defenders see one, the question is less “were credentials stolen?” and more “which accounts, sessions, and services have already been exposed?”
What to watch for: Match the URL in the record against your asset inventory, remote access paths, SaaS tenants, and admin portals. The most important follow-up is whether the account still has an active session, whether the password is reused elsewhere, and whether the service has weak MFA or legacy authentication enabled.
Practitioner takeaway: Treat ULP data as evidence of identity compromise, then validate exposure against both the named service and any linked sessions or recovery paths.
Related resources from NHI Mgmt Group
- What breaks when CI/CD pipelines can list tables with long-lived credentials?
- Who should own unsubscribe and suppression list governance?
- How should organisations respond when a jurisdiction is added to the FATF grey list?
- What do security teams get wrong about posture reports that list hundreds of findings?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org