QLogs 1000 MIX Apr 26, 2025: 40,984 US Credentials in Twin May 26 Dual-Drop Release

Dropped Together: How QLogs Released Two MIX Batches on the Same Day

On May 26, 2025, the QLogs operator made a strategic choice -- or cleared a backlog -- by releasing two distinct MIX batches simultaneously. The QLogs 1000 MIX Apr 26 arrived alongside its sibling, the 2000 MIX Apr 25, in what appears to be a coordinated dual-drop covering two seperate collection windows. Together, the two releases accounted for 3,000 files and over 115,000 US credential records published in a single day. The Apr 26 batch's contribution: 1,000 files, 40,984 records, and a ~30-day staging window that mirrors the companion batch almost exactly.

QLogs 1000 MIX (April 2025): Stealer Log Summary

• Records Exposed: 40,984
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 26, 2025

~30-Day Staging: A Pattern, Not an Anomaly

When the Apr 25 and Apr 26 batches are viewed together, the ~30-day hold on both looks less like an oversight and more like a deliberate release strategy. The operator collected batches on consecutive days in late April, then held both until late May before pushing them simultaneously. This behavior is consistant with an operator building a release schedule around distribution channel readiness rather than collection velocity. By late May, the QLogs pipeline appears to have been established well enough to begin regular publishing -- and the Apr 25/26 pair was the inaugural flush.

~41.0 Records Per File: MIX Baseline in the Early Series

At approximately 40.98 records per file, the 1000 MIX Apr 26 batch reflects typical MIX-tier yields from the pre-VIP era of QLogs. MIX batches draw from heterogeneous endpoint pools -- no strict targeting by consumer profile or corporate affiliation -- which naturally produces lower per-file record counts than focused PCS harvests. Later QLogs MIX batches that earned the VIP label would exceed this yield by a significant margin, often reaching 50+ records per file. The Apr 26 batch establishes the baseline from which the operation's quality metrics would eventiually climb.

What the Dual-Drop Reveals About the QLogs Operation

An operator releasing two backdated batches on the same day is sending a signal to the breach ecosystem: the pipeline is now open. The Apr 25 and Apr 26 MIX batches, both held for ~30 days and released together, function as a launch event for what would become one of the more consistent US infostealer log series of mid-2025. Within weeks of this dual release, the operator transitioned to much shorter staging windows -- sometimes same-day -- and introduced the VIP tiering system that would define the series going forward.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including the foundational QLogs MIX batches from April and May 2025. If your email was captured by infostealer malware during this period, a scan at HEROIC's breach scanner will tell you immediately.