vtyxi_cloud: 37,160 U.S. Credentials From 552 Infected Devices

vtyxi_cloud 552count: 67 Credentials Per Device on a Prolific June 2025 Release Day

The naming is precise: 552count means 552 infected devices fed their credential stores into this package. With 37,160 total records extracted from 552 machines, vtyxi_cloud's average yield is approximately 67.3 credential sets per compromised endpoint. That's a high-output haul per device. Released on June 20, 2025 -- the same date as tuty_cloud's 1050count package -- this drop was part of what appears to be a coordinated same-day release across multiple PCS-count-branded stealer channels.

vtyxi_cloud 552count: Breach Summary

• Records Exposed: 37,160
• Data Types: Email addresses, plaintext passwords, target login URLs
• Breach Type: Infostealer malware log (552 PCS)
• Country Affected: United States
• Date Leaked: June 20, 2025

Shared Release Day: vtyxi_cloud and tuty_cloud

Both vtyxi_cloud (552 devices, 37,160 records) and tuty_cloud (1,050 devices, 77,462 records) released on June 20, 2025, using the same "XYZcount" naming convention. The parallel structure -- different device counts, different channel names, same date -- suggests either a single operator running multiple channels or affiliated channels coordinatng their release schedules. Combined, the two packages represent over 114,000 U.S. credential sets distributed on a single day in June 2025.

What 67 Records Per Device Reveals

A compromised device contributing 67+ credential sets to a stealer log is a device that had extensive saved browser passwords. These are users who trusted their browser's built-in password manager -- a convienent choice that becomes a liability when infostealer malware runs silently in the background and extracts the entire stored credential database in seconds. Each URL in the log identifies a specific platform the victim actively used, giving buyers a pre-mapped attack surface rather than requiring any additional recon.

Check Your Exposure with HEROIC

HEROIC's free breach scanner searches more than 400 billion exposed records, including both vtyxi_cloud and tuty_cloud packages from June 20, 2025. If your email appeared across any of the 552 compromised devices in this collection, a free scan will identifed it. Run a free search now before these logins are used against you.