Part 5 of the Xavier Group Premium Leak Exposes 18,531 More Records

18,531 Records Leaked in Part 5 of the Xavier Group Premium Stealer Log

HEROIC analysts tracked a fifth installment of the "Xavier_Group Premium" stealer log series, labeled part5, after it was uploaded by a Telegram user on 12-Jul-2026. This installment alone contains 18,531 records made up of email addresses, plaintext passwords, and the URLs those credentials unlock.

Why This Is Dangerous

The fact that this is part 5 of an ongoing series means the same source has already distributed multiple batches of stolen credentials, and this batch is just as usable as the ones before it. Because the passwords are stored in plaintext and matched to specific URLs, anyone who downloads this file can attempt to log in directly, no additional cracking or guessing required.

What Was Exposed in Xavier Group Premium Part 5

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

With 18,531 working email and password combinations in circulation, attackers can run automated credential stuffing attacks against banking, email, and shopping sites to see which passwords still work. Anyone in this batch who reused a password elsewhere is at risk of account takeover, unauthorized charges, or having their identity used to open new accounts in their name.

How the Xavier Group Premium Stealer Logs Are Built

Stealer logs like this one come from infostealer malware that infects a victim's computer and quietly copies every saved password, autofill entry, and login session it can find. The malware then bundles that stolen data by victim, pairing each password with the exact site it opens, which is why this dump reads like a ready-made login list. Operators split large hauls into numbered parts, like this part5 file, before uploading them to Telegram channels and dark web marketplaces in batches.

Check If You Are Affected

If your email could be one of the 18,531 records in this leak, or in one of the other Xavier Group Premium parts already circulating, HEROIC's free breach scanner checks it against a database of more than 400 billion exposed records. Run a free scan today and update any password you may have reused.