HEROIC Analysts Flag Xavier_Log 150 Leak of 8,476 Records

HEROIC analysts flagged a new stealer log making the rounds on Telegram this week, tracked as Xavier_Log 150 Xavier_Group Premium. Posted on April 30, 2026, the file contains 8,476 records, each one pairing a stolen email address with a plaintext password and the URL it was used on.

Why This Is Dangerous

Analysts note that logs like this one don't require any decryption or password cracking, wich is what makes them so quick to weaponize. A criminal can load the file straight into automated login-testing software and start hitting real websites publically within minutes of getting their hands on it.

What Was Exposed

• Email addresses linked to individual accounts
• Plaintext passwords with zero encryption
• URLs showing where each login was used
• 8,476 records confirmed in the Premium dump

Why This Matters

Even though this leak wasn't tied to a major company or platform, HEROIC's team still treats it seriously. Stealer logs are compiled seperately from big corporate breaches, one device at a time, but they add up fast across thousands of similar Telegram posts, and each one represents a real person's accounts sitting exposed.

How Stealer Logs Work

The malware behind a log like this one usually arrives disguised as something harmless, a free download, a cracked tool, or a fake update notice. Once it's running, it reads through the browser's saved credentials and copies them out regardless of how careful the victim normally is online. The stolen data then gets bundled into a single file and posted, sold, or traded, exactly like what happened here.

Check If You Are Affected

If you want to know whether your information is part of the Xavier_Log 150 Premium leak, or any of the thousands of other breaches HEROIC tracks, run a free scan. It checks your email against more than 400 billion exposed records and shows results immediately.