Xavier_Group – 400 Xavier_Log Free uploaded by a Telegram User

We've been tracking a steady rise in stealer log proliferation across Telegram channels, but what caught our attention about the recent **Xavier Group** leak wasn't just the volume of credentials—it was the speed with which it surfaced and the specificity of the exposed data. The data had been circulating quietly, but we noticed the unusually clear and targeted nature of the scraped information: not just generic user data, but API endpoints and other developer-specific data. This suggested a more targeted scraping effort than we typically observe.

Xavier Group Leak: 19,735 Records Exposed Via Telegram

In August 2025, a Telegram user uploaded a stealer log file revealing 19,735 records associated with the Xavier Group. The data included endpoints, email addresses, API hosts, and, alarmingly, plaintext passwords. The breach was quickly disseminated through a Telegram channel known for sharing stealer logs, indicating a rapid exploitation and distribution cycle.

The breach was discovered on August 19, 2025, when our automated monitoring systems detected a new post on a known Telegram channel used for sharing stealer logs. The post contained a file named Xavier_Group – 400 Xavier_Log Free, which immediately raised a red flag due to its clear naming convention and explicit mention of a company name. What made this stand out was the plaintext passwords, which is unusual for stealer logs which usually store hashed passwords. This suggests a potential compromise of internal systems or poorly secured development environments.

This incident matters to enterprises because it underscores the ongoing risk posed by stealer logs, especially those containing sensitive developer-related information. The presence of plaintext passwords dramatically increases the risk of account takeover and lateral movement within an organization. The rapid dissemination through Telegram channels highlights the speed at which compromised data can spread, emphasizing the need for proactive monitoring and incident response.

• Total records exposed: 19,735
• Types of data included: Email Addresses, Plaintext Passwords, URLs, API Hosts
• Sensitive content types: Credentials, potentially internal API documentation
• Source structure: Stealer log file
• Leak location(s): Telegram channel
• Date of first appearance: August 19, 2025

The proliferation of stealer logs on Telegram channels and dark web forums is a well-documented phenomenon. Security researchers at BleepingComputer have reported on the use of Telegram bots for selling stolen credentials and data, highlighting the platform's role in facilitating the trade of compromised information. The fact that this breach was shared on Telegram underscores the platform's continued importance as a marketplace for cybercriminals. The ease with which these logs are shared and accessed amplifies the risk to organizations, necessitating constant vigilance and proactive threat hunting.