Telegram – Xavier_Group – 415 Xavier_Log uploaded by a Telegram User

We've been tracking a steady rise in stealer log activity across various Telegram channels, but what caught our attention with the recent Xavier_Group leak wasn't just the volume of records—it was the specific configuration details exposed. The typical stealer log contains the usual credentials and cookies, but this one included internal API hostnames and other endpoint details. The data had been circulating for a few days, but we noticed a spike in related chatter, suggesting active exploitation.

The Telegram Stealer Log Exposing API Endpoints and 13K Credentials

In September 2025, a user on Telegram uploaded a stealer log file, dubbed Xavier_Log, revealing 13,009 records compromised from various endpoints. The file contained a mix of email addresses, plaintext passwords, and internal URLs. This breach is categorized as a stealer log, indicating that the data was likely exfiltrated from compromised machines via malware designed to harvest credentials and other sensitive information.

The Xavier_Log file was discovered on September 12, 2025, when a Telegram user uploaded it to the Xavier_Group channel. While the channel itself is not particularly large or well-known, the contents of the log file raised immediate concerns. What made this breach stand out was the inclusion of internal API hostnames alongside the standard mix of credentials. This suggests that the compromised machines had access to sensitive internal resources, potentially allowing attackers to bypass traditional perimeter security measures.

This breach matters to enterprises now because it highlights the ongoing risk posed by stealer logs and the potential for these logs to expose not just user credentials, but also critical infrastructure details. The inclusion of internal API hostnames significantly increases the potential attack surface, allowing malicious actors to target internal systems and services directly. The leak underscores the importance of robust endpoint security measures, including anti-malware software, regular security audits, and employee training on phishing and other social engineering tactics.

• Total records exposed: 13,009
• Types of data included: Email Addresses, Plaintext Passwords, URLs, API Hostnames
• Sensitive content types: Credentials, Internal Infrastructure Details
• Source structure: Stealer Log File
• Leak location(s): Telegram - Xavier_Group Channel

Stealer logs are frequently traded and sold on Telegram channels and dark web marketplaces. A recent report by Recorded Future highlighted the growing prevalence of stealer logs as a source of compromised credentials. They noted a significant increase in the number of logs containing sensitive enterprise data, which aligns with our findings in this breach. Additionally, discussions on Breach Forums and other online communities often reference stealer logs as a valuable resource for attackers seeking to gain initial access to target networks.