AlphaFreeLogs 87count Stealer Log: 3,961 US Records From April 14 Pre-Campaign

The Opening Move: AlphaFreeLogs 87count and the April 14 Pre-Campaign

The AlphaFreeLogs 87count file, uploaded to Telegram on April 14, 2025, appears to be the earliest known batch in the AlphaFreeLogs distribution campain that peaked with the April 18 and April 23 releases. With just 87 infected US devices yielding 3,961 records, this is the smallest batch in the entire series -- but its timing, four days before the mass April 18 upload, suggests it may have served as a test release or preveiw batch to establish the operator's credibility within Telegram credential trading communities before revealing the full harvest.

AlphaFreeLogs 87count (April 2025): Breach Summary

• Records Exposed: 3,961
• Data Types: Email addresses, plaintext passwords, endpoint URLs
• Breach Type: Stealer log
• Device Count (PCS): 87 infected devices
• Password Type: Plaintext -- browser-extracted, no cracking required
• Country: United States
• Date Leaked: April 14, 2025

The Proof-of-Concept Release Strategy

In Telegram-based credential markets, free log releases often serve a dual purpose: providing immediate value to the community while also advertising the operator's capabilities for future paid offerings. A small release four days before a large cluster is a classic proof-of-concept distribution opeartion -- the 87count batch demonstrates that the AlphaFreeLogs logs are real, recent, and contain valid credentials, setting the stage for the higher-volume April 18 and April 23 batches to be received credibly. This sequencing strategy is common among experienced infostealer operators who understand that reputation within these communities determines how quickly their full harvests get exploited.

Per-Device Density: 45 Credentials per Machine

At 3,961 records across 87 devices, the 87count batch averages approximately 45 credentials per infected machine -- a density profile consistent with the broader AlphaFreeLogs series and indicative of moderately active everyday users. The 87 infected devices likely represent an early segment of the overall infection campaign, possibly targeting a specific geographic area, user demographic, or malware distribution vector before the campaign was scaled to the hundreds of devices seen in later batches.

Small Batch, Persistent Risk

Despite its small size, the 3,961 records in the AlphaFreeLogs 87count batch represent real users with real active credentials. Small batches distributed for free on Telegram circulate as widely and as persistently as large ones -- the file remains available for download indefinitely, and credentials that haven't been changed since April 14, 2025 remain valid attack vectors today. The modest scale of the 87count batch should not be interpreted as reduced urgency for those whose email addresses appear within it.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address appears in known stealer log datasets including the AlphaFreeLogs 87count batch. Even a small stealer log represents complete credential exposure for every affected user -- checking takes under a minute.