Analysts Find ArtHouse Cloud Logs Leaking 26,882 Passwords

In July 2026, HEROIC analysts identified a stealer log file named "ArtHouse Cloud NEW Logs v1" being shared on a Telegram channel. The file contains 26,882 records, each pairing an email address with a plaintext password and the login URL the credential was captured from.

Why the ArtHouse Cloud Logs Leak Is Dangerous

The "NEW" and "v1" labels in the file name suggest this is the first release in what could become an ongoing series, similar to other ArtHouse-branded log dumps HEROIC has tracked. This data was not stolen from a hacked website. It was harvested directly from infected computers by information-stealing malware, which quietly copies saved browser passwords before sending them to whoever runs the operation. Because each record already pairs a specific website with a working email and password, an attacker can log straight in without any guesswork.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact site each credential unlocks)

Why This Matters

Because the passwords in this file are plaintext and already matched to their websites, they are immediately usable for credential stuffing and account takeover. Anyone caught up in this leak risks losing access to email, shopping, or financial accounts, especially if the same password protects more than one account elsewhere.

How ArtHouse-Style Cloud Log Dumps Are Built

Stealer logs like this one come from malware infections, not database breaches. A victim installs a cracked program, clicks a phishing link, or downloads a fake update, and hidden malware then quietly harvests every saved username, password, cookie, and autofill entry from the browser. Data from many infected machines is bundled into a single file, versioned and labeled like "v1" as new releases come out, then shared or sold on Telegram channels and dark web forums.

Check If You Are Affected

With 26,882 credential pairs in this file, checking your exposure takes only a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your email or passwords have been exposed and secure your accounts before they are misused.