JohnDoeProject Stealer Log: 32,597 Credentials Leaked (Jun 2025)

The Second JohnDoeProject Log in Eight Days Confirms a Sustained Campaign Pattern

When the same anonymized campaign name appears twice within a single month -- first on June 20, 2025 with 33,237 records, then again on June 28 with 32,597 -- it stops being coincidence and starts being a pattern. The second JohnDoeProject stealer log distributed via Telegram on June 28, 2025 maintained nearly identical scale to the first upload while retaining the same anonymized branding. For security researchers, two near-identical uploads eight days apart from the same operator suggests either a two-part batch distribution strategy or a campaign structured to release data in discrete tranches rather than all at once.

JohnDoeProject Stealer Log (June 2025): Breach Summary

• Records Exposed: 32,597
• Data Types: Email addresses, plaintext credentials, endpoint URLs, API hosts
• Breach Type: Stealer log
• Country Affected: United States
• Date Leaked: June 28, 2025

Two-Phase Distribution: Why Operators Split Stealer Log Releases

The JohnDoeProject campaign's two-upload structure -- June 20 and June 28, eight days apart -- mirrors a strategy security researchers have documented across multiple stealer log campaigns. Operators split releases for several reasons: to test a smaller batch first and gauge detection or response before releasing the remainder; to sell the first batch to premium buyers before releasing the second publicly; or to manage upload logistics for very large collections that would otherwise exceed Telegram file size constraints.

The near-identical record counts between the two JohnDoeProject uploads (33,237 and 32,597) suggest the operator collected a single large dataset of approximately 65,000+ records and released it in two roughly equal tranches. For the 32,597 individuals in the June 28 upload, the significant risk is that their credentials may have been in the operator's possession since before the June 20 release -- potentially monetized privately before appearing on Telegram.

The June 2025 Stealer Log Cluster: A Broader Pattern

The second JohnDoeProject upload on June 28, 2025 appeared as part of a broader cluster of stealer log distributions in mid-June 2025 that also included the first JohnDoeProject upload (June 20, 33,237 records) and the PegasusCloud log (June 23, 31,912 records). Combined with this June 28 upload, the cluster totals nearly 100,000 plaintext credential sets from U.S. endpoints distributed within eight days. The density and scale of this cluster suggest either a period of exceptionally high stealer malware activity in the U.S. endpoint landscape or a coordinated operater distributing logs from multiple campaigns through the same Telegram infrastructure.

Endpoint and Developer Credential Risk: The JohnDoeProject Profile

The "Project" naming convention across both JohnDoeProject uploads is consistent with the hypothesis that this campaign specifically targeted development and project environments. Developer endpoints are disproportionately valuable stealer targets -- they store GitHub tokens, API keys, cloud provider credentials, SSH keys, and CI/CD pipeline secrets alongside personal account credentials. A stealer infection on a developer machine can yield credentials that unlock not just personal accounts but entire infrastructure environments.

Organizations should cross-reference employee email addresses against both JohnDoeProject uploads. If any employee appears in either log, the response should extend well beyond a password reset -- including audit of all API keys, cloud provider credential rotation, SSH key review, and potential endpoint forensic analysis to determne if the infection is ongoing.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including both JohnDoeProject stealer log uploads from June 2025. If your email appears in any monitored breach or Telegram-distributed log, you'll receive an immediate alert with next steps. Check your exposure for free at HEROIC.com.