QLogs_Offical 360 MIX May 13, 2025: 13,898 US Credentials in Same-Day Stealer Log Release

Zero Days: The QLogs_Offical 360 MIX Same-Day Stealer Drop

On May 13, 2025, the QLogs operator collected 360 files from infected US endpoints and released them the same day. No staging window. No delay. The QLogs_Offical 360 MIX stands as one of the earliest confirmed same-day releases in the QLogs series -- a pattern that would become more common in June 2025 but was exceptional in mid-May. The 360 files yielded 13,898 US credential records at approximately 38.6 records per file. Small by series standards, but the zero-lag pipeline from harvest to public exposure made this one of the fastest-moving batches in the operator's early catalog.

QLogs_Offical 360 MIX (May 2025): Stealer Log Summary

• Records Exposed: 13,898
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 13, 2025

Same-Day Release: What Zero Staging Means for Victims

When a stealer log batch is released the same day it's collected, victims have no warning window whatsoever. The infostealer compromises the device, extracts credentials, and those credentials are live in the breach ecosystem before the victim would have any reason to suspect a problem. For the 13,898 individuals in this batch, their passwords -- captured in plaintext directly from browser sessions -- were available to threat actors on May 13, likely within hours of the infection. By the time any monitoring service could flag the exposure, the credentials were already accessible to anyone watching the QLogs distribution channel.

360 Files and ~38.6 Records Per File

At 360 files, the QLogs_Offical 360 MIX is one of the smaller batches in the early series. Alongside irregular counts like 530, 750, 1005, and 3220 from this same era, the 360 figure reflects the pre-standardization phase of QLogs packaging -- the operator releasing whatever the infostealer network produced rather than curating to a predetermind archive size. The ~38.6 records-per-file yield is consistent with standard MIX-tier performance, drawing from a heterogeneous US endpoint pool without the focused consumer targeting that would produce higher density in dedicated PCS batches.

May 13 as a High-Activity Collection Day

The QLogs operator had a busy May 13. Beyond this 360 MIX batch, the operator also collected two PCS batches on the same date -- 750 files and 500 files -- both of which were staged for five days before releasing May 18. The same-day 360 MIX drop and the deferred PCS batches suggest the operator applied diferent staging logic to different batch types on the same collection day: MIX content went out immediately, while PCS content went through a longer preparation window. This differential treatment offers a rare glimpse into how the QLogs operation managed its internal workflow during the pre-VIP era.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including same-day QLogs_Offical MIX releases from May 2025. A scan at HEROIC's breach scanner will tell you whether your credentials were among the 13,898 exposed in this batch.