Slurm Logs Jun 18 2025: 36,879 U.S. Credentials in First of Three Mid-June Drops

HEROIC's DarkHive intelligence system discovered the Slurm Logs data breach dated June 18, 2025, exposing 36,879 records. This Telegram-distributed stealer log was the first of three releases across four days (June 18, 20, and 22), confirming the Slurm Logs campaign was operating in mid-June 2025. It contains email addresses, plaintext passwords, and login URLs captured by infostealer malware from U.S. user devices.

Why This Is Dangerous

Stealer logs expose plaintext credentials captured live at the point of login. Each of the 36,879 records contains a working password tied to the exact website where it was submitted. Attackers recieving this data can begin credential stuffing attacks against banking, email, and social media platforms immediately with no decryption required. Thier automated tools can validate thousands of accounts per hour across multiple platforms simultaneously.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs

Why This Matters

The June 18 dataset is among the earliest confirmed drops in the Slurm Logs series, carrying the longest exposure window of the campaign. Credentials have been in attacker hands since mid-June 2025, well before breach monitoring services indexed the data. Credential stuffing, identity theft, and financial fraud are the primary risks. Password reuse across seperate platforms amplifies the damage from any single captured credential pair. The consistent every-other-day release cadence starting June 18 shows this was a well-organized operation, not opportunistic, meaning the data was likely distributed to multiple buyers immediatly upon release.

How Stealer Logs Work

Infostealer malware spreads through phishing emails, fake downloads, and compromised websites. Once silently installed on a victim device, it captures every login: the email address, the plaintext password, and the target URL. This data is exfiltrated to operator servers and published in batches through Telegram channels like Slurm Logs. The every-other-day release pattern indicates the operator was accumulating credentials continuously and releasing them on a deliberate schedule.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs SlurmLogs uploaded by a Telegram User. Visit heroic.com to scan your email address and find out if your credentials were exposed in this June 18, 2025 stealer log release or any other drop in the series.