AuroraLogsTeam 503count: 29,021 US Records and 58 Credentials Per Device

AuroraLogsTeam's March 30 Warmup: 503 Devices and 29,021 US Stolen Records

The AuroraLogsTeam 503count batch, released March 30, 2025, was released the day preceeding the campaign's massive 1830count anchor batch -- 1,830 devices and 132,386 records on March 31. At 503 devices and 29,021 records, the 503count represents the final release before that peak, and its 58-credential-per-device density shows a particularly credential-rich infection population. The 503count is a reminder that in the AuroraLogsTeam campaing, even the "smaller" batches between anchor releases expossed tens of thousands of plaintext credentials across hundreds of infected US devices.

AuroraLogsTeam 503count (March 2025): Breach Summary

• Records Exposed: 29,021
• Data Types: Email addresses, plaintext passwords, endpoint URLs, API host data
• Breach Type: Stealer log
• Device Count (PCS): 503 infected devices
• Password Type: Plaintext -- directly usable with no cracking required
• Country: United States
• Date Leaked: March 30, 2025

58 Credentials Per Device: High-Density Pre-Anchor Infection

The 503count batch's 58-credential-per-device average is substantially higher than the campaign's April average (35-48 per device) and rivals the density of the March 31 anchor batch (72 per device). At 58 credentials stored per browser, the March 30 infection population represents users who aggressively relied on browser credential storage -- likely individuals who saved credentials for every service they used, from financial platforms to internal workplace tools. The 503 devices that generated this dataset collectively produced 29,021 credential-to-URL pairings, each immediately actionable against the specific platform where the credential authenticates.

Endpoint URLs and API Host Data: The Double Exposure

The 503count dataset includes both endpoint URLs and API host data alongside the plaintext credentials. Endpoint URLs identify the specific consumer-facing login pages where each credential is valid. API host data goes deeper -- it reveals the backend infrastructure that applications on each infected device communicated with, potentially including internal enterprise systems, cloud provider APIs, and developer tool endpoints. For each of the 503 infected devices, this dual exposure means attackers have both the user-facing credential path and the infrastructure-level data that surrounds it. At 58 credentials per device, that's a substantial volume of both consumer and infrastructure intelligence per compromised machine.

March 30 in Campaign Timeline: The Pre-Anchor Build

The 503count's March 30 release occupies a structurally important position in the AuroraLogsTeam campaign: it preceded the massive March 31 1830count by a single day. This back-to-back release pattern -- 503 devices on March 30, 1,830 devices on March 31 -- mirrors other campaign patterns where medium-scale releases immediately preceded anchor batches. The March 30/31 sequence added over 161,000 records to the campaign's total in just 48 hours. The 503count's density (58 creds/device) was higher than many subsequent batches, suggesting the March 30 infection cluster drew from a particularly credential-dense user population that the malware had been seeding for longer than the rapid April deployments that followed.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records including stealer log data from AuroraLogsTeam's March-April 2025 campaign. If your credentials were stored on one of the 503 March 30 infected devices, they are in active circulation alongside the campaign's broader dataset. Search for free at HEROIC.com to find out where your information has appeared.