QLogs VIP 1365 MIX 09-09-2025: 46,866 US Stealer Log Credentials Released September 2025

QLogs VIP 1365 MIX: 46,866 US Credentials Released September 17, 2025

QLogs VIp 1365 MIX 09-09-2025 is a stealer log batch uploaded to Telegram on September 17, 2025, containing 46,866 US-targeted credential records harvested from 1,365 infected endpoints. The batch name's inconsistent capitalization -- "VIp" rather than "VIP" -- appears to be a typo in the original Telegram post but does not affect its classification as a premium-tier release. Collection date "09-09-2025" (September 9, 2025 in European format) gives an 8-day window between infection campaign compilation and distribution. The per-file yield of approximately 34.3 records per endpoint is notably higher than the QLogs VIP 1315 MIX batch released a week later (~24.2 records/file), suggesting the 1365 batch drew from a more credential-dense infection event or a curated selection of higher-yield endponts.

QLogs VIP 1365 MIX (September 2025): Stealer Log Summary

• Records Exposed: 46,866
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: September 17, 2025

Yield Comparison Across QLogs Batches

The QLogs operator released multiple VIP-tier batches in a short window across August-September 2025, each with different yield profiles. The 1365 MIX batch (~34.3 records/file) represents the highest per-endpoint yield in the confirmed QLogs series, followed by the 1575 MIX batch (~32.3 records/file, August 28, 2025 collection) and the 1315 MIX batch (~24.2 records/file, September 15, 2025). The September 3, 2025 "1065 PCS" batch (~27.2 records/file) lacks the VIP label, suggesting lower-tier distribution. Yield variation across batches is expected when malware campaigns target different user demographics or platform types: endpoints belonging to users with many saved browser credentials produce higher-yield logs, while endpoints from users with minimal saved passwords produce low-yield logs. The 1365 batch's higher yield suggests either better targeting in the underlying infection campaign or post-infection curation that filtered out the lowest-quality logs before distribution.

Stealer Log Operations in September 2025: The QLogs Pattern

The QLogs series confirms that Telegram-based stealer log distribution remains active and high-volume in 2025. The operator released at least four confirmed batches between August 28 and September 22, 2025, totaling over 157,000 US credential records across approximately 5,320 infected endpoints. The tight release cadence -- multiple batches within weeks -- is consistant with either a high-volume continuous infection campaign or a bulk aggregation model where logs purchased from multiple infection operators are rebranded and redistributed under the QLogs label. Both models are common in the 2025 stealer log marketplace. The "MIX" suffix on premium batches indicates these are geographically mixed rather than country-pure releases, even though US credentials predominate in the exposed data.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including the QLogs VIP 1365 MIX batch. Stealer log credentials are captured from active browser sessions, meaning the exposed password reflects what you were using at the time of infection -- changing an old unused password won't protect you if the breach captured a current credential. Check your exposure at HEROIC's breach scanner and prioritize password changes on your highest-value accounts immediately.