Write a function that takes a credit card number in the format "1234 5678 9012 3456" and returns a string with all but the last four digits replaced with an "X". Use a regular expression to match a group of four digits followed by a space and replace them with "XXXX ".