14,672 Xavier Group Cloud Leak: Credentials Exposed July 2025

We've been tracking a steady increase in stealer log activity on Telegram channels over the past quarter, but what caught our attention with the recent Xavier Group leak wasn't just the volume of data, but the clarity and structure of the exposed information. The data had been circulating quietly, but we noticed the specific naming convention and the unusual inclusion of API host information alongside standard credentials suggested a targeted approach, possibly aimed at developers or system administrators. This breach stands out because it offers a glimpse into the specific types of data that attackers are actively targeting through stealer malware campaigns.

Xavier Group Breach: 14,672 Records Exposed in Telegram Leak

The Xavier Group, a company name identified within the stealer logs, suffered a data breach after a user uploaded a file containing 14,672 records to a Telegram channel on July 30, 2025. This incident was discovered when our team detected the file being shared within known Telegram channels frequented by threat actors. What made this stand out was the inclusion of not just email addresses and passwords, but also URLs and API host information, suggesting a potential compromise of development or testing environments. This matters to enterprises now because it highlights the ongoing risk of stealer malware and the potential for sensitive data to be exfiltrated and shared on public platforms. It ties into broader threat themes surrounding the automation of attacks and the monetization of stolen data through Telegram marketplaces.

Breach Stats:
* Total records exposed: 14,672
* Types of data included: Email Addresses, Plaintext Passwords, URLs
* Source structure: Stealer Log File
* Leak location: Telegram Channel
* Dates of first appearance: July 30, 2025

The breach was described as a stealer log file containing endpoints, email, API host information, and passwords. The availability of plaintext passwords is particularly concerning, as it significantly increases the risk of credential stuffing attacks.

While there's no mainstream media coverage of this specific breach as of this writing, the incident aligns with a broader trend of stealer logs being traded on Telegram, as reported by cybersecurity researchers. One Telegram post claimed the files were "collected from devs testing an AI project".