The ArtHouse Best Cloud v2 Leak: 12,058 Passwords Exposed. Yours Might Be One.

HEROIC analysts identified a stealer log upload on a public Telegram channel dated October 2, 2025, labeled ArtHouse Best Cloud v2. The file was detected during active monitoring of illicit credential-sharing communities and flagged immediately for analysis. The dataset contained 12,058 records drawn from compromised endpoints, with the v2 designation suggesting this was a second installment in a series of credential collections targeting cloud platform users. Our team verified the dump as authentic. The data includes email addresses, plaintext passwords, and service URLs captured directly from infected devices through infostealer malware.

Why This Is Dangerous

Twelve thousand plaintext credentials distributed via Telegram is an immediate threat. Attackers who obtained this file can begin testing each credential pair against major platforms within minutes, using automated tools that attempt logins at scale across banking, email, and cloud services simultaneously. The v2 label signals an organized, ongoing campaign rather than a one-time incident, meaning additional batches of credentials from the same source may already be in circulation. Every record in this dump represents a real person whose accounts are at immediate risk of unauthorized access.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Service and API Host URLs

Why This Matters

Stealer log credentials feed directly into the credential stuffing ecosystem. Once a valid email and password pair is confirmed to work on one platform, it is often sold or used to access others where the victim reuses the same password. This chain leads to account takeovers, identity theft, fraudulent financial activity, and in corporate environments, potential access to internal systems and sensitive business data. The inclusion of API host URLs in this dump means attackers may also gain programmatic access to backend services, not just front-end user accounts. The damage from a single valid credential can compound rapidly.

How Stealer Log Campaigns Work

Stealer log campaigns follow a repeatable cycle. First, malware is distributed through phishing emails, cracked software, or malicious browser extensions. Once installed on a victim's device, it silently harvests stored credentials, session tokens, and browsing data. That data is exfiltrated to a command-and-control server controlled by the attacker. The attacker then packages the harvested credentials into log files, often named after the target platform or a campaign identifier like ArtHouse Best Cloud. These packages are distributed in versioned batches (v1, v2, and so on) through Telegram channels and underground forums. Each batch may represent a new wave of infections or a curated subset of the full haul. Victims typically have no warning that their credentials have been captured.

Check If You Are Affected

The ArtHouse Best Cloud v2 Leak affected 12,058 accounts. Yours might be one. If you used any cloud platform or administration service in late 2025 and have not audited your accounts since, you should check now. HEROIC's breach search covers more than 400 billion compromised records and is updated continuosly. Go to heroic.com, enter your email address, and see wheather your credentials appeared in this breach or any other verified data incident in our database.