JUNE 7 – 4100 LOGS: 72,184 Records Exposed (September 2023)

The Third JUNE 7 Batch: Completing 234,000 Records From One Campaign

JUNE 7 - 4100 LOGS is the final piece of the JUNE 7 stealer log campaign -- the third of three batches released simultaneously on September 26, 2023, joining JUNE 7 - 4121 LOGS (86,386 records) and JUNE 7 - 4211 LOGS (76,622 records). Together, the three JUNE 7 batches cover 12,432 devices and over 234,700 plaintext credentials. All of it from a single day of infection. All of it held for approximately 111 days before release.

JUNE 7 - 4100 LOGS (September 2023): Breach Summary

• Records Exposed: 72,184
• Data Types: Usernames, plaintext passwords, endpoint URLs, API hosts
• Breach Type: Stealer log
• Date Leaked: September 26, 2023

4,100 Devices and the Final JUNE 7 Tally

JUNE 7 - 4100 LOGS contributes 4,100 compromised endpoints and 72,184 records to the series, at an average of roughly 17.6 credentials per device. This is consistent with the other JUNE 7 batches (~18 and ~21 per device respectively), reinforcing the argument that all three batches came from the same uniform infection vector -- a single malware deployment hitting similarly structured devices on June 7, 2023.

Combined with its two companion batches, the full JUNE 7 campaign produced: 12,432 infected devices, 234,792 total records, and a consistent per-device yield averaging roughly 18-21 credentials per endpoint. That uniformity is a fingerprint. Different malware variants, different infection campaigns, or different device populations would produce more variable yields. The JUNE 7 series' consitency points to a single, well-tuned deployment.

Why Three Batches Instead of One?

The operator's decision to split 12,432 devices into three separate named batches -- rather than one monolithic dump -- reflects sophisticated distribution strategy. Three separate uploads allow simultaneous posting to multiple Telegram channels, each batch reaching a different audience. Three separate named packages are harder for defenders to correlate into a single campaign. And three separate releases generate three separate instances of underground market engagement.

Releasing all three simultaneously on September 26 maximized the flood effect: defenders and security researchers trying to monitor the clearing event had to track three JUNE 7 uploads alongside dozens of other concurrent releases. The signal-to-noise ratio made it practically impossible to respond to any individual batch before the credentials had already reached broad distribution.

The JUNE 7 Series as the Largest Contributor to the September 26 Cluster

With 234,000+ records from 12,000+ devices, the JUNE 7 series is the single largest contributor to the September 26-27, 2023 clearing event by volume. Combined with the MAY series (MAY 4, MAY 5, MAY 8 batches) and the dozens of other named releases in the cluster, the total credential exposure from the September 26-27 event reaches well into the hundreds of thousands of plaintext records.

For potential victims, the final JUNE 7 batch carries the same risk as the first: 72,184 plaintext credentials have been in undergorund circulation since September 26, 2023, passed through combolist aggregators, credential stuffing campaigns, and dark web forums. Accounts compromised in June 2023 that haven't had passwords changed remain vulnerable today.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including all three JUNE 7 batches and thousands of other stealer log releases. Run a free scan to find out if your email, username, or password has appeared in any known breach or leak.