The Xavier_Ulp 500600 Dump Contains Exactly 279,594 Email and Password Pairs

On February 3, 2026, HEROIC analysts identified a stealer log file circulating on a private Telegram channel under the name Xavier_Ulp - 500600 Xavier_Group. The file contained exactly 279,594 records, each consisting of an email address, a plaintext password, and the URL of the account those credentials belong to. The data was verified by HEROIC's dark web monitoring team and added to our breach index of over 400 billion compromised records.

This upload is the third identified release from the Xavier_Group campaign, arriving just one day after the 402800 batch. The rapid cadence of uploads confirms this is an active, ongoing operation rather than a one-time data dump.

Why the Xavier_Ulp 500600 Credentials Are Ready to Use Right Now

Plaintext passwords require no additional processing by an attacker. Unlike bcrypt or SHA-256 hashed passwords that need to be cracked before use, plaintext credentials from a stealer log can be loaded directly into a credential stuffing tool and deployed against hundreds of websites within minutes of downloading the file.

The inclusion of URLs makes this even worse. An attacker with this file doesn't need to guess which sites a victim uses. They have a list. They can target your bank, your email provider, your shopping accounts, and your social media all from a single file. If you use the same password on more than one site, a single match here could unlock everything.

What the Xavier_Ulp 500600 File Contained

• Email addresses
• Plaintext passwords (immediately usable, no cracking needed)
• Account URLs showing exactly which services were targeted

279,594 complete credential records. Every single one was stolen directly from an infected device, meaning the passwords were accurate and active at the time of collection.

What Three Xavier_Group Uploads in Two Days Tells Us

The Xavier_Group campaign operates at a pace that suggests an automated infrastructure. Batches labeled 402200, 402800, and 500600 were uploaded within days of each other, with hundreds of thousands of records in each. This is not a hobbyist operation. It reflects an organized criminal enterprise running infostealer malware at scale.

For victims, the implication is serious. Credentials stolen in this campaign may be sold multiple times, shared across criminal forums, and used for attacks over months or years. Even if a credential stuffing attempt fails today because a password was recently changed, the email address itself retains value for phishing campaigns and future attack attempts.

Identity theft, fraudulent account creation, and finantial fraud are all downstream consequences of this type of exposure.

How the Xavier_Ulp Stealer Log Got Your Passwords

Infostealer malware is typically delivered through deceptive downloads: cracked software, fake game mods, malicious PDF attachments, or compromised websites. Once a user runs the file, the malware installs quietly in the background and begins harvesting saved credentials from browsers like Chrome, Firefox, and Edge.

It also captures data from password manager extensions, autofill forms, and active session cookies. Within seconds, the malware has a complete picture of the victim's saved logins. That data is bundled and sent to the attacker, often without triggering any antivirus alerts because the malware is designed to look like legitimate software.

The collected logs from many infected devices are then merged into large files like the Xavier_Ulp 500600 upload and distributed through Telegram channels to buyers and accomplises.

Search Your Email: Check If You Are in the Xavier_Ulp 500600 Leak

If your email address is in this file, an attacker already has your password for at least one account. HEROIC's free breach scanner searches more than 400 billion compromised records, including this file and every other Xavier_Ulp upload we have indexed.

Enter your email at HEROIC to check your exposure. If you get a match, change the affected passwords immediately, stop reusing passwords across sites, and turn on two-factor authentication wherever it is available. These steps won't undo the exposure, but they will significantly reduce what an attacker can do with the data.