Xavier_Group Stealer Log Hits 100,583 US Accounts and Passwords

On July 19, 2026, a threat actor operating as "Xavier_Group" uploaded a stealer log to a Telegram channel, exposing 100,583 records tied to United States accounts. The data includes email addresses, plaintext passwords, and associated URLs, all harvested from malware-infected devices.

Why This US-Linked Xavier_Group Leak Is So Large

At over 100,000 records, this is one of the larger stealer log dumps to surface recently, and the data is tied to accounts based in the United States. Rather than coming from a single hacked website, this volume points to Xavier_Group aggregating credentials from a large number of infected devices across the country and packaging them into one combined file for distribution on Telegram.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs (the login pages tied to each credential)

Why This Matters

With more than 100,000 US accounts in a single file, the odds that your information is included are meaningfully higher than with a smaller leak. Attackers use automated credential stuffing tools to test each leaked email and password combination against banking, email, and shopping sites in bulk. If your password shows up here and you have reused it elsewhere, you face real risk of account takeover, identity theft, and financial fraud.

How Xavier_Group Style Leaks Get Assembled

Infostealer malware spreads through phishing emails, fake software downloads, and cracked programs, then silently copies every password and autofill entry saved in an infected device's browser. Groups like Xavier_Group compile these individual infections into large combined logs, sometimes reaching six figures in record count, before sharing or selling them on Telegram, exactly how this 100,583-record file came together.

Check If You Are Affected

Given the scale of this US-linked leak, it is worth checking your exposure directly rather than assuming you are not one of the 100,583 affected accounts. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including large stealer logs like this one, so you can find out in seconds and secure your accounts before an attacker does.