QLogs 1204 MIX Apr 16, 2025: 21,234 US Credentials in the Operator’s Earliest Documented Batch

The Lowest-Yield QLogs Batch: What ~17.6 Records Per File Reveals About the Apr 16 Collection

Collected on April 16, 2025 and released May 13 after a ~27-day hold, the QLogs 1204 MIX batch stands apart from the rest of the series for one striking reason: its per-file yield. At approximately 17.6 records per 1,204 files -- yielding 21,234 total US credentials -- this batch sits dramatically below the yields seen in every subsequent QLogs release. The early April collection date makes this one of the earliest known batches in the series, possibly the operator's very first foray into US endpoint harvesting before the infostealer network had reached full deployment. What we're likely seeing is an emerging botnet in its initial infection phase, before targeting refinement had taken hold.

QLogs 1204 MIX (April 2025): Stealer Log Summary

• Records Exposed: 21,234
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 13, 2025

~17.6 Records Per File: Diagnosing the Low Yield

Every subsequent QLogs MIX batch exceeded 37 records per file; most ranged from 40-50+. The Apr 16 batch at ~17.6 is an outlier that demands explanation. Three interpretations are plausible. First, the earliest infections in the botnet may have targeted lower-value endpoints -- casual users with few stored browser credentials. Second, the infostealer variant deployed in April may have had a narrower capture scope, missing some credential stores that later versions would hit. Third, and perhaps most interesting: the 1,204-file count is irregular, and some files may have been near-empty captures -- endpoints where the stealer ran but found few credentals to harvest. Any combination of these factors could produce the anomalously low yield seen here.

April 16: Earlier Than the "Earliest" Batch

The QLogs 2000 MIX Apr 25 batch was previously understood to be among the earliest in the series -- but the Apr 16 1204 MIX predates it by nine days. Both batches were released around May 13-26, in what appears to be an initial clearing of a backlog that had built up during April and early May. The Apr 16 batch's ~27-day staging window aligns closely with the Apr 25 batch's 31-day hold, supporting the interpretation that the QLogs operator spent April collecting without yet establishing a regular release cadence. The dual late-April/early-May clearing event may represent the operator's first coordinated push to distribute accumulated harvests.

~27-Day Staging: Consistent With the Operator's Early Behavior

The gap between April 16 collection and May 13 release fits the pattern established by other early QLogs batches. April and early-May collections consistently sat for 16-31 days before release. By mid-May, the operator had begun releasing within days or same-day. The Apr 16 batch, held for ~27 days, is further evidence that the QLogs pipeline was not yet optimized during this earliest period -- a fact corroborated by the low yield, the irregular file count, and the eventule standardization that would come in June 2025.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including the earliest-documented QLogs batches from April 2025. A scan at HEROIC's breach scanner will surface any exposure regardless of when the batch was collected or released.