QLogs VIP 1500 PCS: 76,090 US Credentials From a Batch With an Impossible Date

Impossible Date, Very Real Damage: QLogs VIP 1500 PCS Drops 76,090 US Records

On July 8, 2025, a batch named "QLogs VIP 1500 PCS 28-26-2025" surfaced on threat actor forums with 76,090 US credentails drawn from 1,500 malware-infected endpoints. The date embedded in the name -- "28-26" -- is an impossible value; no calendar month corresponds to the number 26. The most plausible interpretation is a transposition error for "28-06," placing the original collection on June 28, 2025. Under that reading, the operator staged this batch for roughly ten days before the July 8 release, a window that mirrors the MIX batch staging pattern but applied here to a VIP-tier PCS package at an unusually large file count.

QLogs VIP 1500 PCS (July 2025): Stealer Log Summary

• Records Exposed: 76,090
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: July 8, 2025

1,500 Files: The Largest PCS Release by File Count

This batch represents the highest file count seen in any single QLogs PCS release across the observed 2025 dataset. While the operator typically packages PCS batches at 500 files, the 1,143-file VIP PCS from June 23 was already unusual. Scaling to 1,500 files suggests either a deliberate consolidation of several smaller collectoins harvested over a multi-day window or a single large-scale infection campaign targeting a broad US consumer endpoint pool. The per-file yield of approximately 50.7 records -- well above the ~38-40 threshold for VIP designation -- confirms the quality standard was met at scale, not just in smaller curated releases.

July 8 Dual Release: Staging Backlog Theory

QLogs published two separate batches on July 8, 2025: this 1,500-file release and the QLogs VIP 500 PCS 08-07-25. The simultaneous publication of a large-file batch and a standard 500-file batch suggests the operator was clearing a staging backlog rather than releasing in real time. The 1,500-file package, if collected June 28, had accumulated for ten days; the 500-file package appears to be a genuine same-day release. Publishing both simultaneously maximizes forum presence without depressing per-record pricing -- a calculated distribution tactic consistent with an operator managing inventory across multiple collection windows and release channels.

Plaintext Passwords Ready for Immediate Exploitation

All 76,090 records in this batch carry plaintext passwords -- values captured directly from browser credential stores by malawre operating on victim endpoints before any server-side hashing occurs. Chrome, Edge, and Firefox each store saved passwords in local encrypted files that infostealer malware routinely decrypts using the user's own Windows session keys. The result is a credential set requiring no cracking whatsoever: email-password pairs are immediately usable for credential stuffing, account takeover, and lateral movement into enterprise systems accessed from personal devices. At 76,090 US records, the attack surface spans potentially thousands of distinct organizations.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to determine whether your email address or password has appeared in stealer log datasets like this one. Batches like QLogs VIP 1500 PCS carry real and immediate risk -- plaintext credentials require no preparation before use in credential stuffing attacks. Run a search at HEROIC's breach scanner and update any matched passwords without delay.