Dark Web Intel: Xavier_Ulp Stealer Log Exposes 346,578 Logins

HEROIC's dark web monitoring picked up a fresh dump this week: the Xavier_Ulp - 457899 Xavier_Group file, posted by a Telegram user, holding 346,578 records of stolen credentials. This is exactly the kind of intel our scanners are built to catch before it spreads further across dark web marketplaces.

Why This Is Dangerous

What makes this particular find concerning is the scale. Over three hundred thousand login combinations is alot of accounts sitting exposed, all harvested directly from infected devices rather than pulled from an old, outdated database. Fresh credentials like these tend to still be active, wich makes them far more valuable to criminals then old leaks that have already been changed.

What Was Exposed

• 346,578 total records
• Email addresses
• Plaintext passwords
• Website URLs linked to each set of stolen credentials

Why This Matters

Once a file like this circulates on the dark web, it rarely stays in one place. Copies get resold, repackaged, and combined with other leaks, so even if you never hear about this specific dump again, your information could keep resurfacing in new combolists for months or years. Occured breaches like this often feed directly into future credential stuffing attacks.

How Stealer Logs Get Built

Malware infections are usually the starting point. A user downloads a cracked program or clicks a bad link, and the malware quietly starts recording saved passwords, browser cookies, and autofill fields in the background. Everything gets compiled into a log file and shipped off to the attacker, who then dumps it publicly or sells access to it, wich is how it ends up in channels like this one.

Check If You Are Affected

Rather than wondering if you're in this dump, you can check directly. HEROIC's free breach scanner searches over 400 billion compromised records for your email or credentials, giving you a clear answer in seconds so you can take action right away if needed.