U.S. Users Targeted: Xavier_Group Exposes 1,790 Passwords

HEROIC identified a stealer log batch labeled Xavier_Log 211 from the Xavier_Group Telegram channel in July 2026. The file targets predominantly U.S.-based users and contains 1,790 records, each pairing an email address with a plaintext password and the URL of the website where the credentials were captured by malware.

The Immediate Threat of Plaintext Password Exposure

All 1,790 passwords in this Xavier_Group batch are stored in plaintext, without any hashing or encryption. This is the worst-case scenario for credential exposure. Attackers can read and use each password the moment they access the file. There are no computational barriers, no time delays, and no additional tools needed to turn these stolen credentials into unauthorized access.

What Was Exposed

• Email Addresses — personal and professional login identifiers for online services
• Plaintext Passwords — fully exposed, readable passwords with no protection layer
• URLs — website addresses revealing which services each victim used

Why Credential Stuffing Makes Every Reused Password Vulnerable

Attackers commonly use credential stuffing tools to test stolen email-password pairs against major services like Gmail, Microsoft, Amazon, and online banking portals. Because people frequently reuse passwords, a single credential from the Xavier_Log 211 file can be leveraged to compromise multiple accounts belonging to the same person. The practice turns one breach into a cascade of unauthorized access across platforms.

Infostealer Malware: The Source of Xavier_Group Data

Every entry in this collection was harvested by infostealer malware running on a compromised device. These infections typically originate from phishing campaigns, trojanized applications, or drive-by downloads from malicious websites. The malware silently extracts stored credentials from web browsers, records keystrokes, and captures session tokens. The stolen data is then packaged into log files and uploaded to the Xavier_Group channel where it becomes available to threat actors at no cost.

Check If Your Credentials Were Exposed

If you are based in the United States, this breach is especially relevant to you. Use the HEROIC data breach scanner to search more than 400 billion compromised records and determine if your email or password appears in the Xavier_Log 211 collection or any other breach. Finding your data early gives you the chance to change passwords and enable two-factor authentication before an attacker can exploit your credentials.