Inside Xavier_Group Stealer Logs: 327,371 Passwords Taken

HEROIC tracked a stealer log archive labeled Xavier_Ulp - 531601 Xavier_Group that was uploaded to Telegram in June 2026. The dataset contains 327,371 credential records extracted from compromised devices, attributed to a threat group operating under the Xavier name. The structured nature of this dump suggests an organized credential harvesting operation targeting users at scale.

Plaintext Passwords Require Zero Processing to Exploit

All 327,371 passwords in this dump are stored in plaintext format. This means the passwords were captured by malware and recorded exactly as typed, with no encryption or obfuscation applied. From a technical standpoint, there is no cracking phase, no rainbow table lookup, and no brute-force computation needed. Each credential is immediately actionable for unauthorized login attempts.

What Was Exposed

• Email Addresses — unique account identifiers enabling cross-platform credential testing and targeted social engineering
• Plaintext Passwords — raw credentials captured from browser password stores and form submissions
• URLs — the endpoint addresses of websites and services where credentials were captured, providing a precise attack map

Credential Stuffing at Scale With 327K Records

With over 327,000 email-password pairs, attackers can execute large-scale credential stuffing campaigns across every major online service. Automated tools test each pair against banking portals, email services, streaming platforms, and enterprise applications in parallel. The high volume makes statistical success nearly certain: even a low hit rate produces thousands of compromised accounts ready for exploitation, fraud, or resale.

The Xavier_Group Infostealer Operation

The Xavier_Group label on this dump indicates an organized operation distributing infostealer malware through multiple infection vectors. These typically include trojanized software downloads, phishing emails with weaponized attachments, and malicious browser extensions. The malware hooks into browser credential storage systems to extract saved passwords, intercepts active session cookies, and collects system metadata. The resulting data is structured into ULP-format log files and distributed through dedicated Telegram channels operated by the group.

Check If Your Credentials Were Exposed

HEROIC's breach database indexes over 400 billion records from stealer logs, data breaches, and credential dumps. Use HEROIC's breach scanner to check whether your email or password appeared in the Xavier_Group collection and take immediate steps to secure any affected accounts.