Telegram – Xavier_Group – 334 Xavier_Log uploaded by a Telegram User

We've been tracking a noticeable uptick in stealer log data appearing on Telegram channels specializing in "developer resources" – often a thinly veiled front for compromised credentials and infrastructure access. What really caught our attention with this particular leak wasn't the volume of records, but the apparent targeting of development environments and cloud infrastructure. The data had been circulating for a few days before we identified it, but the potential impact on software supply chains made it a priority. The setup here felt different because it appears to have been specifically curated for access to API keys, cloud service accounts, and internal development tools, rather than general user credentials.

The "Xavier_Group" Leak: 17,695 Records of Development Credentials on Telegram

In late June 2025, a Telegram user uploaded a stealer log file named "334 Xavier_Log" to the Xavier_Group Telegram channel. This channel is known for sharing various types of data, with a focus on what it describes as "resources for developers". Our analysis of the log revealed 17,695 records, primarily consisting of email addresses, plaintext passwords, and associated URLs. While the exposure of plaintext passwords is concerning in itself, the more alarming aspect is the nature of the targeted endpoints.

We discovered the file on June 29, 2025, while monitoring several Telegram channels known to host stealer logs. The file stood out due to the URLs associated with the compromised credentials. Instead of targeting common websites or services, a significant portion of the records pointed to development-related URLs, including API endpoints, cloud service consoles, and internal development tools. This suggests a targeted campaign aimed at gaining access to sensitive development infrastructure. The data's presence on Telegram is consistent with the increasing use of the platform as a marketplace for stolen credentials, as reported by several security firms, including a recent analysis by Recorded Future highlighting the ease with which threat actors can buy and sell stolen data on Telegram. The exposed data types included Email Addresses, Plaintext Password, and URLs.

This breach matters to enterprises because it highlights the ongoing risk posed by stealer logs and the increasing sophistication of threat actors targeting development environments. Access to API keys and cloud infrastructure credentials can allow attackers to inject malicious code into software supply chains, compromise sensitive data, or launch further attacks against internal systems. This incident underscores the need for robust credential management practices, including multi-factor authentication, regular password rotation, and monitoring for compromised credentials. It also ties into the broader threat theme of automated attacks leveraging stealer logs, where attackers use automated tools to extract and exploit credentials from compromised systems. This particular incident highlights the need to monitor Telegram channels and other similar platforms for leaked credentials that could impact enterprise security.

• Total records exposed: 17,695
• Types of data included: Email Addresses, Plaintext Passwords, URLs
• Sensitive content types: API host
• Source structure: Stealer log file
• Leak location(s): Telegram - Xavier_Group
• Dates of first appearance: 29-Jun-2025

Security researcher Brian Krebs has repeatedly warned about the dangers of stealer logs and their availability on underground forums. In a recent article on KrebsOnSecurity, he noted that "stealer logs are increasingly becoming a primary source of credentials for attackers, as they provide a wealth of information about compromised systems and user accounts." The presence of plaintext passwords in this leak is especially concerning. While password storage best practices have been widely publicized, the continued prevalence of plaintext passwords in these leaks suggests that many organizations still fail to implement proper security measures. One Telegram post claimed the files were "collected from devs testing an AI project".