QLogs 500 PCS Jun 20, 2025: 20,675 US Credentials at the Start of the Pre-VIP Cluster

QLogs 500 PCS Jun 20, 2025: 20,675 US Records From the Start of the Pre-VIP Cluster

The batch "QLogs 500 PCS 20-06-2025" opens the four-day pre-VIP-label cluster of same-day QLogs PCS releases that spans June 20-23, 2025. At 20,675 US credentials across 500 stealer log files, the per-file yield of approximately 41.35 records just barely clears what would become the VIP threshhold days later, yet no VIP label was applied. This is consistent with the broader Jun 20-23 pattern: all four batches in this cluster yield above the eventual threshold but none carry the VIP designation, confirming the label was not part of the PCS naming convention at this stage of the series.

QLogs 500 PCS (June 20, 2025): Stealer Log Summary

• Records Exposed: 20,675
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: June 20, 2025

The Evolution of the QLogs PCS Pipeline

The June 20 batch sits at the beginning of what appears to be a rapid evolution in the QLogs distribution model. On June 8, the operator released two split-part 1,000-file PCS packages (QLogs.part1 and QLogs.part2). By June 20, they had standardized to single 500-file releases. By June 23, they were scaling to 1,000 files in a single batch. By June 26, the VIP label had been introduced and the 1,500-file format had emerged. The ten-day window from June 20 to June 30 represents the most rapid structural change in the series -- from informal pre-tier 500-file releases to a formalized VIP/non-VIP tiering system with variable file counts. The Jun 20 batch is the first data point in that collectoin of changes.

Plaintext Passwords Ready for Immediate Use

The 20,675 records in this batch carry plaintext passwords extracted by malawre operating on US consumer endpoints -- values taken directly from browser password stores before any server-side hashing occurs. For threat actors, each record is immediately deployable in credential stuffing campaigns against US banking portals, e-commerce platforms, and enterprise SSO systems. The Jun 20 batch is not the largest or highest-yield release in the series, but its plaintext format makes it equally dangerous on a per-credential basis as any VIP-labeled batch published later.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address or password has appeared in stealer log datasets like this one. Regardless of batch size or operator tier labeling, infostealer-harvested plaintext credentials carry immediate risk. Search your email at HEROIC's breach scanner and update any matched passwords before they're used against you.