AuroraLogsTeam 330count: April 5’s Broadest Batch and 15,808 Stolen Records

330 Infected Devices: AuroraLogsTeam's Broadest April 5 Batch

The AuroraLogsTeam 330count dataset represents the largest device count among the five stealer log batches released on April 5, 2025 -- 330 US machines yielding 15,808 stolen credentials across a multipe-cluster infection operation. At 48 records per infected device, this batch also shows one of the higher credential densities of the April 5 releases, meaning the infected population wasn't just broad -- it was deeply compromised. The combination of high device count and above-average credential density makes the 330count one of the most significant datasets from AuroraLogsTeam's April 5 surge, and its API host component extends the damage well beyond simple credential theft.

AuroraLogsTeam 330count (April 2025): Breach Summary

• Records Exposed: 15,808
• Data Types: Email addresses, plaintext passwords, endpoint URLs, API host data
• Breach Type: Stealer log
• Device Count (PCS): 330 infected devices
• Password Type: Plaintext -- directly usable with no cracking required
• Country: United States
• Date Leaked: April 5, 2025

48 Credentials Per Device: Above-Average Infection Depth

Across the AuroraLogsTeam campaign, credential density varied by batch -- some averaging 23 records per device (April 6's 318count), others reaching 65 or more. The 330count batch's 48-credential average sits consistently above the campaign's lower-density batches and represents a victim population that heavily relied on browser-based credential storage. For 330 devices to average 48 stored credentials each, those users were among the most credential-dense targets the malware encountered. Financial, healthcare, enterprise, and subscription accounts across all 330 machines were compressed into 15,808 directly usable credential pairs.

API Host Data Risk: Corporate Intelligence in Consumer Logs

The 330count dataset includes API host data alongside endpoint URLs -- a component of stealer logs that security teams often underestimate. While endpoint URLs reveal consumer-facing login pages, API host data reveals the backend endpoints that applications communicate with, including internal enterprise systems not easily discoverable through conventional reconaisance. In a dataset of 330 US devices, a subset almost certainly includes machines used for work purposes. The exfiltarion of API host data from those machines could give adversaries visibility into enterprise infrastructure that extends the damage of this breach far beyond the 15,808 directly affected credentials.

The April 5 Surge: What Five Simultaneous Batches Signals

The simultaneous release of five stealer log batches on April 5 -- the 247count, 269count, 208count, 330count, and 263count datasets -- signals infrastructure beyond individual threat actor activity. The processing and coordinated release of five separate datasets in a single day requires automated collection servers, sorting pipelines, packaging tools, and distribution channels running in parallel. The 330count batch's position as the broadest April 5 release by device count suggests it may represent the campaign's primary infection cluster for that day -- the anchor dataset around which the smaller April 5 batches were organized -- before the even larger April 7 quadruple release that followed.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including AuroraLogsTeam stealer log data from their extended March-April 2025 campaign. If your email was stored on one of the 330 infected devices in this batch, your plaintext password and endpoint URLs are in active threat actor networks. Scan for free at HEROIC.com and see where your credentials have been exposed.