26,122 Passwords Leaked in the ArtHouse Cloud Logs v3 Stealer Log

HEROIC analysts identified a stealer log dataset called ArtHouse Cloud Logs v3 that was uploaded to a Telegram channel on July 27, 2026. The file contained 26,122 records made up of email addresses, plaintext passwords, and the URLs those credentials were used on. Why This Is Dangerous: Because the passwords in this dataset were stored and leaked in plaintext, anyone who downloads the file can use the credentials immediately, with no cracking or decoding required. Paired with the URL each password was tied to, an attacker can log straight into the matching account on the first try. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each set of credentials Why This Matters: Stealer logs like this one are a favorite tool for credential stuffing attacks. If any of these 26,122 email and password pairs match logins used elsewhere, such as banking, email, or shopping accounts, attackers can attempt automated logins across hundreds of other sites. Reused passwords turn one small leak into access for many accounts, opening the door to account takeover, financial fraud, and identity theft. How a Stealer Log Like This Works: A stealer log is created when malware infects a device, quietly collects saved browser passwords, autofill data, and session details, then sends everything back to whoever controls the malware. The operator packages the harvested logins into a file like this one and distributes it through Telegram channels or dark web marketplaces, often for free or a small price, putting it in reach of a wide range of attackers almost immediately. Check If You Are Affected: HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including datasets like this one, so you can find out in seconds if your credentials were exposed. Run a free scan today and change any reused passwords before someone else uses them first.