AlphaFreeLogs 112count Stealer Log: 5,727 US Records From April 14, 2025

The Second April 14 Batch: AlphaFreeLogs 112count Stealer Log

Uploaded on the same day as the AlphaFreeLogs 87count batch, the 112count file exposed 5,727 records from 112 infected US devices on April 14, 2025. As the second batch in the AlphaFreeLogs series -- released four days before the larger April 18 cluster -- the 112count file represents a continuation of the operator's proof-of-concept distribution strategy. The inclusion of API host data alongside email/password/URL records suggests that at least some of the techincal devices targeted by this batch had access to backend systems or development infrastructure, elevating the risk profile above standard consumer credential theft.

AlphaFreeLogs 112count (April 2025): Breach Summary

• Records Exposed: 5,727
• Data Types: Email addresses, plaintext passwords, endpoint URLs, API host data
• Breach Type: Stealer log
• Device Count (PCS): 112 infected devices
• Password Type: Plaintext -- browser-extracted, no cracking required
• Country: United States
• Date Leaked: April 14, 2025

API Host Data in the April 14 Context

The presence of API host information in the 112count batch -- shared with several other AlphaFreeLogs batches in the series -- indicates a consistent pattern in the underlying malware's harvesting opperations. The infostealer used in the AlphaFreeLogs campaign was configured to capture not just browser-stored web credentials but also API configurations and host endpoints encountered during normal device use. For US-based technical users whose devices were infected, this means their cloud infrastructure credentials, developer API keys, and backend service access tokens were captured alongside their personal email passwords and social media logins.

Two Batches, Same Day: The April 14 Micro-Cluster

The simultaneous release of 87count and 112count on April 14 -- totaling 9,688 records from 199 devices -- mirrors the larger multi-batch release pattern of April 18. Even at a smaller scale, the dual-batch April 14 release suggests the operator was already prevelant in practicing the segmented distribution approach that became the hallmark of the AlphaFreeLogs series. April 14 was likely the initial distribution test, with April 18 and April 23 serving as the full campaign rollout.

Credential Persistence and Ongoing Risk

Stealer log credentials from April 14, 2025 remain valid for any account where the user has not rotated their password since infection. For the 5,727 records in the 112count batch, the plaintext passwords captured represent the active credentials those users were using at the time -- credentials that continue to function as keys to their accounts unless explicitly changed. The free distribution of these records on Telegram means they have been accessed by an unknown but potentially large number of threat actors over the months since upload.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address appears in known stealer log datasets including the AlphaFreeLogs April 2025 series. Technical users and developers should treat any credentials potentially captured in April 2025 as compromised until verified otherwise.