Xavier_Group – 362 Xavier_Log Free uploaded by a Telegram User

We noticed an unusual surge in activity originating from a Telegram channel known for distributing compromised credential dumps. Specifically, a file labeled "Xavier_Log Free" was uploaded on October 16, 2025, containing what appeared to be a collection of endpoint data. What struck us was the inclusion of plaintext passwords alongside email addresses and associated URLs, indicating a direct compromise of user sessions or local credential storage rather than a traditional database breach.

The uploaded file, identified as a stealer log, contained 18,397 records. Analysis revealed that these records primarily consist of email addresses, plaintext passwords, and associated URLs, likely representing the API hosts or websites accessed by the compromised endpoints. The source structure points towards a credential-stealing malware campaign that successfully exfiltrated data from numerous user machines. The leak locations are currently confined to the aforementioned Telegram channel, but the potential for further dissemination and exploitation is significant given the nature of the exposed data.

While this specific leak has not yet garnered widespread media attention, the methodology aligns with a growing trend of attackers leveraging infostealer malware to harvest credentials. Similar incidents involving the exfiltration of plaintext passwords from endpoint devices have been documented by various cybersecurity research firms, highlighting the persistent threat posed by such tools. The ease with which these logs are often shared on public platforms underscores the need for robust endpoint security and user education regarding credential hygiene.