ARCEUSULP 87 Stealer Log Exposed 93,857 Email-Password Pairs

ARCEUSULP 87 Stealer Log Exposed 93,857 Email and Password Pairs

On July 2, 2026, HEROIC analysts identified a stealer log labeled "ARCEUSULP 87 306263," part of a numbered series tied to a source operating under the ARCEUSULP name. The file contained 93,857 records, each combining an email address, a plaintext password, and the URL the login was used on.

Why This Is Dangerous

Because this release is one entry in an ongoing numbered series, it points to a source that has been harvesting and releasing credentials repeatedly rather than as a single event. With 93,857 plaintext passwords ready to use, attackers can begin testing logins immediately, and the existence of a series suggests related batches may already be circulating elsewhere.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

Nearly 94,000 exposed credentials is enough volume to support meaningful credential stuffing attempts against email providers, banks, and online retailers. Because this appears to be part of an ongoing series from the same source, individuals affected may find their information appearing in multiple related leaks over time, increasing the long-term risk of account takeover and identity theft.

How Stealer Logs Work

Numbered releases like "ARCEUSULP 87" typically come from an operation that runs infostealer malware campaigns continuously, harvesting saved browser logins from newly infected devices and periodically packaging the results into fresh batches. This particular release, the 87th in its series, contained 93,857 records and was distributed through Telegram alongside other similarly labeled files.

Check If You Are Affected

Because this source appears to release new batches regularly, checking your exposure is worth doing more than once. HEROIC's free breach scanner searches more than 400 billion leaked records, including ongoing stealer log series like ARCEUSULP, to show you if your email address has been compromised. Run a free scan now and change any exposed password immediately.