Xavier_Group – 460 Xavier_Log Free uploaded by a Telegram User

We're seeing an uptick in stealer logs surfacing on Telegram channels, and while the volume isn't always massive, the targeted nature and potential for follow-on attacks make them a persistent concern. We first noticed this particular log file due to its unusual naming convention, "Xavier_Group – 460 Xavier_Log Free," which suggested a specific target rather than a broad sweep. What really struck us wasn't the number of records—just over **14,000**—but the inclusion of what appeared to be internal API host information alongside email addresses and passwords. This combination hints at a potentially compromised development or testing environment. The data had been circulating quietly, but we noticed increasing chatter around it within a closed Telegram group dedicated to leaked credentials.

Xavier Group Leak: 14,000 Records Expose API Hosts and Plaintext Passwords

A stealer log file, named "Xavier_Group – 460 Xavier_Log Free," was uploaded to Telegram on August 15, 2025. The file contained 14,028 records apparently harvested from compromised endpoints. What caught our attention was the co-mingling of email addresses, plaintext passwords, and what appear to be internal API host URLs. This suggests the compromised system may have had access to sensitive internal resources or was used for development and testing. The leak matters to enterprises now because it provides attackers with potential entry points into Xavier Group's systems, including the possibility of lateral movement and further data exfiltration. This incident underscores the broader threat theme of stealer logs acting as initial access vectors, particularly when they expose internal infrastructure details.

• Total records exposed: 14,028
• Types of data included: Email Addresses, Plaintext Passwords, URLs (likely API host addresses)
• Sensitive content types: API host information, potentially revealing internal infrastructure.
• Source structure: Stealer log file (format not specified)
• Leak location(s): Telegram channel
• Date of first appearance: August 15, 2025

The incident aligns with a broader trend of stealer logs being used to target specific organizations. A recent report by CrowdStrike details how initial access brokers actively trade stealer logs containing sensitive information like API keys and internal URLs. This reinforces the idea that even seemingly small leaks can have significant consequences. One Telegram post claimed the files were "collected from devs testing an AI project," though this remains unverified. The plaintext passwords are a particularly egregious finding, highlighting a critical security lapse in the affected environment. This echoes findings from previous breaches where developers inadvertently committed sensitive information to public repositories, as detailed in a GitGuardian report on exposed API keys.