HEROIC Analysts Discover Xavier Group Leak of 283,822 Records

HEROIC analysts discovered a fresh stealer log making the rounds on Telegram this week, tied to the identifier Xavier_Ulp - 420000 Xavier_Group. After pulling the file apart, the team confirmed 283,822 individual records inside, each one a real login lifted from an infected device.

Why This Is Dangerous

What stood out to analysts wasn't just the volume, it was how clean the data was. Nothing in this file is encrypted or masked, the passwords sit right there in plaintext next to the matching email and the web address they belong to. That combination is basically a login form pre-filled for whoever downloads it.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs for each account

The full count sits at 283,822 records, all pulled from the same batch of infected machines.

Why This Matters

Analysts flagged this one because stealer logs like this tend to sit quietly online untill someone with bad intentions notices them, and by then the data has often already been copied and recirculated several times. Anyone wich reused a password from one of these accounts on another site is at risk too, since credential stuffing tools can test the same login across hundreds of platforms in minutes.

How Stealer Logs Work

A stealer log starts as malware, usually delivered through a pirated program, a phishing email, or a malicious browser extension. Once installed, it quietly digs through saved browser data, pulling out usernames, passwords, and cookies before shipping it all to the attacker. The attacker then compiles everything into a log file and either sells access to it or dumps it publicly, which is exactly how HEROIC's analysts recieved this one during routine monitoring.

Check If You Are Affected

Rather than wonder if your email is sitting in a file like this one, run it through HEROIC's free breach scanner. It checks against a database of more than 400 billion leaked records and gives you a straight answer in seconds, so you can change any exposed passwords before someone else gets to them first.