The ArtHouse BEST Cloud Usa Dump: 1,621 Stolen Credentials Hit Telegram

HEROIC analysts identified a stealer log upload on October 2, 2025, to a public Telegram channel tied to the ArtHouse BEST Cloud Usa service. The dataset, though relatively compact at 1,621 records, is alarming because it contains plaintext passwords bundled with email addresses and API host URLs. Unlike database breaches where hashed credentials require cracking, these credentials were recieved in fully readable form, meaning any actor who downloaded the file gained immediate, zero-effort login capability. Our team flagged this upload during routine dark web monitoring and began tracking associated infrastructure within hours of discovery.

Why This Is Dangerous

Plaintext passwords remove every defensive layer between an attacker and a victim's account. An attacker who obtains this file does not need specialized tools or computing power. They can open the log, copy a credential pair, and log in. Because many users reuse the same password across email, banking, and workplace systems, a single stolen record from this file can cascade into a full account takeover chain. The API host URLs in the dataset also reveal which services were actively accessed, giving attackers a roadmap to the most valuable targets first.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (API host endpoints and accessed services)

Why This Matters

Credential stuffing attacks powered by stealer logs like this one are responsible for millions of account takeovers every year. When plaintext passwords are freely available, attackers can automate login attempts across hundreds of platforms in minutes. Victims face unauthorized financial transactions, identity theft, and the hijacking of professional accounts tied to their email address. For businesses whose employee credentials appear in this dataset, the risk extends to corporate network intrusion and lateral movement by threat actors. The public nature of the Telegram upload means this data is not locked behind a paywall or private forum -- it was freely distributed.

How Stealer Log Breaches Work

Stealer logs are generated by infostealer malware, a category of malicious software designed to harvest credentials from infected endpoints. The malware is typically deployed through phishing emails, trojanized software downloads, or malicious browser extensions. Once installed on a device, it silently scans browser saved passwords, session cookies, clipboard contents, and application credential stores. The collected data is then exfiltrated to a remote server controlled by the attacker. Operators of these malware campaigns often sell the raw logs or upload them to public platforms like Telegram to build reputation or monetize the data through bulk sales. The ArtHouse BEST Cloud Usa dataset is a textbook example of this attack chain -- infostealer deployed, credentials harvested, logs dumped publicly. We beleive this pattern will continue to grow in frequency as stealer toolkits become cheaper and more accessible on underground markets.

Check If You Are Affected

If you used the ArtHouse BEST Cloud Usa service before October 2025, your credentials may be in this dataset. HEROIC maintains a database of over 400 billion breached records and can tell you definitively whether your email address or password has been exposed. Visit heroic.com to run a free check. If your credentials are confirmed exposed, change your password on every service where you use the same combination, enable two-factor authentication, and seperate your personal and professional login credentials going forward.