Xavier_Ulp Breach Leaks 169,438 Passwords Like a City’s Worth

HEROIC analysts uncovered a stealer log file, part of the Xavier_Ulp series, uploaded to Telegram in late February 2026. The file holds 169,438 records, each combining a login URL, an email address, and a plaintext password. To put that in perspective, that is roughly the population of a small city, all with their login details sitting exposed in a single downloadable file.

Why This Is Dangerous

Unlike a breached database where passwords are usually hashed and need cracking, this data is stored in plain text. That means an attacker does not need any technical skill or special software to use it. They simply open the file and start testing logins, often gaining access before the victim ever suspects a problem.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each account

Why This Matters

A collection this large is exactly what fuels credential stuffing campaigns, where criminals automate login attempts across banking sites, email providers, and online stores using these exact combinations. Because password reuse is so common, one exposed login can open the door to several accounts at once, leading quickly to account takeover, identity theft, and financial fraud.

How Stealer Logs Work

This type of breach starts with infostealer malware quietly installed on a victim's device, often disguised as a game cheat, cracked app, or fake update. Once active, it scans the browser for saved passwords and autofill data, then compiles everything into a log file. These files circulate on Telegram and dark web marketplaces, where a single upload like this one can affect well over a hundred thousand people at once.

Check If You Are Affected

Rather then hope your information was not swept up in this leak, check for certain. HEROIC's free breach scanner searches a database of more than 400 billion exposed records, including stealer logs like this Xavier_Ulp file. Scan your email now and secure your accounts before someone else logs in first.