Xavier_Group ULP Leak: 165,703 Logins Now Circulating Online

Xavier_Group: a name that's shown up more than once on dark web channels. Its latest file, "Xavier_Ulp - 500000," was uploaded on 04-Dec-2025 and despite the ambitious "500000" in its title, HEROIC's analysts confirmed the real, verified count came to 165,703 records.

Why This Is Dangerous

Groups that brand and package their leaks, like Xavier_Group appears to do, tend to operate more like an organized business than a lone hacker. That usually means better distribution, wich in practice means this file is more likely to reach a wider pool of buyers than a random, unbranded log would.

What Was Exposed

• 165,703 total records
• Email Addresses
• Plaintext Passwords
• URLs tied to each account

Why This Matters

A branded operation like Xavier_Group often reuses the same distribution channels for multiple leaks, wich means if your information showed up in one Xavier_Group file, it's worth checking whether it's appeared in others too. Plaintext passwords in particular give attackers an imediate, ready-to-use way into an account, no extra effort required.

How Stealer Logs Work

A "ULP" file, short for username, login, password, is one of the most common formats infostealer malware produces. The malware infects a device, quietly reads whatever passwords are saved in the browser, and ships them back to the group running the operation, in this case seemingly Xavier_Group, who then formats and distributes the results under their own name.

Check If You Are Affected

Don't guess, check. HEROIC's free breach scanner searches through more than 400 billion compromised records, including this Xavier_Ulp file, so you can know for certain if your login was part of the 165,703 exposed here.