182,568 Passwords Exposed in Xavier_Ulp Data Breach

182,568. That is the number of individual login records HEROIC analysts found inside a stealer log file uploaded to Telegram in late February 2026, part of the Xavier_Ulp series. Each record pairs a website address with an email and a plaintext password, harvested directly from infected devices rather then stolen from a company database.

Why This Is Dangerous

These are not scrambled hashes that need cracking. Every password sits in plain, readable text right next to the account it opens. An attacker with this file does not need any special tools or technical skill. They can simply copy a line and log in, often before the victim has any idea their computer was compromised.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs matched to each credential

Why This Matters

A file of this size is a goldmine for credential stuffing, where attackers test the same email and password combination across dozens of other sites. Because so many people reuse passwords, one leaked login frequently unlocks several accounts, from email to banking. That chain reaction is how a stealer log leads to account takeover, identity theft, and financial fraud.

How Stealer Logs Work

Stealer log malware infects a device silently, often bundled inside cracked software or a fake download link. Once running, it scans the browser for saved passwords, autofill entries, and active login sessions, then exports everything into a single text file. These files are then sold or, as in this case, shared for free on Telegram channels, giving anyone access to hundreds of thousands of working credentials in one download.

Check If You Are Affected

Instead of wondering if your email turned up in a log like this, check it directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer log data exactly like this Xavier_Ulp file. Run a free scan now and take back control of your accounts.