164,685 Records Leaked From Xavier_Group ULP Combolist Drop

164,685. That's how many login records showed up in a single Telegram post on 14-Apr-2026, labeled Xavier_Ulp - 439000 Xavier_Group. Unlike the smaller stealer log files we've covered, this one is a ULP combolist, meaning URL, login, and password data compiled from many different infections into one massive list.

Why This Is Dangerous

A combolist of this size gives attackers alot of raw material to work with all at once. Instead of manually testing accounts one by one, criminals load lists like this into automated credential stuffing tools that hammer login pages across the internet until something sticks.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs
• 164,685 total records exposed

Why This Matters

When a list reaches this scale, it stops being a targeted attack on one company and becomes a general-purpose weapon. Anyone whose email and password recieve a match in this file could see that same combination tried against banking sites, email providers, and social media all in the same afternoon.

How Stealer Logs Work

ULP combolists like this one start life as ordinary stealer logs. Malware infects individual devices, copies out saved browser credentials, and produces small log files one at a time. What makes a ULP list dangerous is the next step: someone gathers dozens or hundreds of those small logs, strips out the useful URL, login, and password data, and merges it all into one giant, searchable file.

Check If You Are Affected

With 164,685 records in play, this is exactly the kind of leak HEROIC's free breach scanner was built for. Enter your email and it's checked instantly against a database of over 400 billion leaked records, so you know right away if you need to change a password.