QLogs 2000 MIX Apr 25, 2025: 74,408 US Credentials in the Earliest Known QLogs Batch

Where It All Began: The Earliest QLogs Batch and Its 31-Day Hold

Every large-scale credential operation has a starting point, and for QLogs -- one of the more prolific US infostealer log series of 2025 -- that starting point appears to be April 25. The QLogs 2000 MIX batch collected on that date sat unplublished for a full 31 days before hitting the breach ecosystem on May 26, 2025. The 74,408 US credentials it carried, harvested from 2,000 endpoints, represent the foundational dataset from which the entire QLogs series grew. What began as an anomalously long staging window would eventually give way to the rapid-fire, sometimes same-day release cadence that came to define the operation.

QLogs 2000 MIX (April 2025): Stealer Log Summary

• Records Exposed: 74,408
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 26, 2025

The 31-Day Staging Window: Early Series Behavior

A 31-day gap between collection and release is the longest observed in the QLogs series. Later batches would routinely ship within days -- sometimes hours -- of collection. The prolonged hold on the Apr 25 batch suggests the operator was still building out their distribution infrastructure in April and May 2025. Alternatively, the batch may have undergone quality processing or been withheld pending a coordinated multi-batch drop. What's notable is that on May 26, the operator released this batch simultaneously alongside the QLogs 1000 MIX Apr 26 batch -- two separate collection windows published on the same day, as if clearing a backlog in a single coordinated release.

~37.2 Records Per File: MIX-Tier Yield in the Pre-VIP Era

At approximately 37.2 records per file, the 2000 MIX Apr 25 batch sits below the yields that would later earn the VIP label. The MIX designation indicates a heterogeneous source pool -- infected endpoints of mixed types, geolocations, or demographic profiles, rather than curated consumer (PCS) or enterprise targets. For the earliest batch in the series, this yield is consistent with an operator still refining its targeting and malware deployment. VIP-labeled MIX batches didn't appear until later in May 2025, and even then the threshold was applied selectivley. The Apr 25 batch predates that entire framework.

Why Plaintext Credentials from 2025 Still Matter

Stealer logs differ from database breaches in one critical way: the passwords are already in plaintext. There is no hash to crack, no algorithm to reverse. Every one of the 74,408 credentials in this batch was captured live from browser sessions or stored credential vaults by infostealer malware running on the victim's machine. For threat actors, these records are immediately usable -- fed into automated credential stuffing tools targeting email providers, financial institutions, and social platforms. The April 2025 collection date means many of these passwords are likely still active for users who haven't been notified of the exposure.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including the earliest QLogs batches and every release that followed. If your credentials appeared in the Apr 25 collection or the May 26 dual-drop, a scan at HEROIC's breach scanner will surface it immediately.