How Malware Led to 107,586 Stolen Logins in Xavier_Group

In July 2026, HEROIC's threat intelligence team traced a large stealer log collection back to the Xavier_Group operation on Telegram. The file contains 107,586 records extracted from infected devices, each entry revealing an email address, a plaintext password, and the URL of the service where the login was used. The sheer volume of this dump illustrates how effectively infostealer malware campaigns harvest credentials at scale.

Plaintext Passwords: No Barrier Between Theft and Abuse

The passwords in this Xavier_Group batch appear in their raw, unencrypted form. There is no hashing algorithm to slow down an attacker and no salting to complicate decryption. Each password can be read and used as-is. For the 107,586 people affected, this means their credentials are immediately actionable by anyone who obtains the file, with no technical skill required beyond basic computer literacy.

What Was Exposed

• Email Addresses — widely used as the primary login credential for online services
• Plaintext Passwords — fully readable, unprotected authentication strings
• URLs — the web addresses of services where victims entered their credentials

From One Leak to Total Account Compromise via Credential Stuffing

Cybercriminals routinely feed large credential dumps into automated tools that test each email-password pair against dozens of popular platforms. With 107,586 pairs available from this single Xavier_Group file, the attack surface is enormous. Any victim who used the same password for their email account, financial services, or workplace login could see multiple accounts compromised from this one data set alone.

The Malware Journey: From Infection to Telegram

Each record in the Xavier_Group dump represents a device that was compromised by infostealer malware. The infection chain typically begins with a phishing email, a fake software crack, or a compromised website that delivers a malicious payload. Once installed, the malware harvests every credential stored in the victim's browsers, along with cookies and autofill data. These stolen records are aggregated into log files and distributed through Telegram channels, where they become freely available to threat actors worldwide.

Check If Your Credentials Were Exposed

A dump this large significantly raises the probability that your data is included. The HEROIC data breach scanner indexes more than 400 billion compromised records, giving you the ability to check whether your email or password appears in this Xavier_Group leak or hundreds of thousands of other breaches. If you find your credentials, change every affected password immediately and enable two-factor authentication to add a critical layer of defense.