QLogs 1065 PCS: 28,957 US Credentials Surface in September 2025 Stealer Log Release

QLogs Drops 1,065-File PCS Batch With 28,957 US Credentials in September 2025

When a QLogs batch lands without the VIP label, it's worth asking what that distinction actally means. QLogs 1065 PCS 03-09-2025 surfaced 28,957 US stealer log records on September 3rd, 2025 -- 1,065 individual files harvested from malware-infected Windows endpoints across the United States. No "VIP" prefix. Just PCS. That labeling choice may seem minor, but in the stealer log marketpace it carries real signal about what buyers are getting -- and what they're not.

QLogs 1065 PCS (September 2025): Stealer Log Summary

• Records Exposed: 28,957
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: September 3, 2025

PCS Without VIP: Understanding QLogs Tier Labels

QLogs batches typically carry one of several suffix combinations: MIX, PCS, VIP, or combinations like "VIP PCS" or "VIP MIX." The VIP label in most stealer log marketplaces indicates premium-tier endpoints -- machines with higher-value credential stores, corporate access, or financial account logins. PCS (personal computers) signals consumer hardware. A batch labeled PCS but not VIP suggests the operator classified this haul as standard consumer-grade yield without flagging any enterprise or high-value anomalies. At ~27.2 records per file, the yield ratio aligns closely with typical MIX batch averages -- nothing anomalous, just a steady consumer credential harvest.

September 2025 Timing and the Late-Summer Surge

This batch landed September 3, 2025 -- shortly after a wave of QLogs releases in late August. The August releases included VIP 900 MIX, VIP 940 MIX, VIP 1000 MIX, VIP 1120 MIX, VIP 1575 MIX, and the anomalous VIP 500 PCS. Moving into September with a 1,065-file PCS drop suggests QLogs maintained consistent harvesting operatons across the late-summer period, with no sign of slowing. The absence of a VIP label here doesn't indicate lower operational tempo -- it may simply reflect a batch that didn't meet whatever threshold the operator uses for the premium designation.

1,065 Files, 28,957 Records: Endpoint Exposure Across the US

Each of the 1,065 files in this batch represents a compromised endpoint -- a Windows machine running infostealer malware (RedLine, Vidar, Lumma, or similar) that silently exfiltrated saved browser credentials. At ~27.2 records per file, the yield is consistent: these were standard consumer machines with moderate credential stores, not high-value corporate endpoints. The extracted data -- email/password pairs tied to specific URLs -- is immediately actionable for credential stuffing without any additional decryption or processing. For victims, the risk is real regardless of which tier label the operator applied.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including stealer log credential sets like this QLogs PCS batch. If your email appeared in an infostealer haul, you'll know immediately. Check your exposure now at HEROIC's breach scanner and take action before your credentials are used against you.