Telegram – Xavier_Group – 359 Xavier_Log uploaded by a Telegram User

We've been tracking a steady increase in stealer log drops on Telegram channels, and while many are relatively small, the aggregate risk they pose to enterprises is significant. We first noticed this particular log file, dubbed **"359 Xavier_Log"**, being shared on the **Telegram channel "Xavier_Group"** on **September 15, 2025**. What really struck us wasn't just the presence of email addresses and passwords, but also the inclusion of API host URLs. This combination suggests a potential for lateral movement within compromised systems and applications. The data had been circulating quietly, but we believe its contents warrant closer examination due to the potential exposure of sensitive API endpoints.

Telegram Channel Exposes 5.5k Credentials and API Endpoints

A stealer log file, uploaded to the Telegram channel "Xavier_Group", exposed 5,574 records containing a mix of email addresses, plaintext passwords, and, critically, API host URLs. The breach was discovered on September 15, 2025, when our team identified the file being shared within the Telegram channel. What caught our attention was the inclusion of API host URLs alongside typical credential data; this suggests the potential for attackers to leverage compromised credentials to access and manipulate sensitive API endpoints, potentially leading to further data breaches or system compromise. This incident highlights the increasing risk posed by stealer logs circulating on Telegram and other platforms, particularly when they contain information that enables attackers to move beyond simple credential stuffing.

• Total records exposed: 5,574
• Types of data included: Email Addresses, Plaintext Passwords, URLs (API Host)
• Sensitive content types: API endpoints
• Source structure: Stealer log file
• Leak location(s): Telegram channel "Xavier_Group"
• Date of first appearance: September 15, 2025

The proliferation of stealer logs on Telegram channels is a well-documented trend. Security researchers have observed a steady stream of compromised credentials and other sensitive data being shared on these platforms. For example, in August 2025, BleepingComputer reported on the increasing popularity of Telegram channels for distributing malware and stolen data. This incident underscores the need for enterprises to actively monitor Telegram and other similar platforms for mentions of their domains or infrastructure, as well as to implement robust credential monitoring and API security measures.