Check If You’re In The 3,125-Record Xavier_Group Log Leak

The most recent file in this string of leaks, Xavier_Log - 200 Xavier_Group Premium, appeared on Telegram on 18-Apr-2026 with 3,125 login records inside. It closes out a run of uploads from the same source over the span of about a week, and it's just as usable to an attacker as every file that came before it.

Why This Is Dangerous

Nothing about this file is scrambled or protected. Emails, plaintext passwords, and URLs sit next to each other in plain view, which is because the malware behind it copies data exactly as the browser stored it, with no extra security layer in between.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs
• 3,125 total records exposed

Why This Matters

It's neccessary to treat every file in a series like this as connected, not isolated. If your data appeared in an earlier Xavier_Group leak, there's a real chance it shows up again here or in whatever file comes next from the same source.

How Stealer Logs Work

This leak, like the others in the series, started as infostealer malware running quietly on an infected device. It copied saved browser credentials, organized them by site, and produced a log file that eventually made its way to a Telegram channel where it was shared publically for anyone to download.

Check If You Are Affected

Before you close this page, take thirty seconds to check whether your email is one of the 3,125 in this leak. HEROIC's free breach scanner searches more than 400 billion leaked records and gives you an immediate, clear answer.