Check If You’re in the ArtHouse Cloud 7,911-Record Breach

HEROIC researchers found 7,911 records on 16-Feb-2023 from ArtHouse Cloud, a Telegram channel that redistributes stealer log files.

Why This Stealer Log Is Dangerous

The ArtHouse Cloud drop contains plaintext passwords alongside matching emails and login URLs. Anyone who downloads the file can log in directly, with no cracking, no rainbow tables, and no brute force. The 7,911 records give attackers a focused, high-quality credential set, and the age of the drop means many of these credentials have been quietly passed around the ecosystem long enough to end up in automated stuffing lists.

What Was Exposed in ArtHouse Cloud

• Email addresses
• Plaintext passwords
• Login URLs and API host endpoints
• Service context showing the exact target of each credential
• Infected endpoint metadata from the original stealer infection

Why This Matters

Even a mid-sized stealer log like ArtHouse Cloud can drive a long tail of account takeovers, especially for users who never changed the exposed password. Because the file lists URLs, attackers can filter instantly for banks, crypto exchanges, business email, and SaaS consoles. If any of those credentials were reused for work accounts, the ArtHouse Cloud drop becomes a direct path to corporate intrusion.

How a Stealer Log Like ArtHouse Cloud Works

Infostealer malware families such as RedLine, Vidar, and Raccoon spread through cracked software, malicious ads, and phishing. Once on a device, they harvest saved browser credentials, cookies, autofill, and wallet data. The operator packages the results into a log, and public redistributors like the ArtHouse Cloud channel reshare those logs on Telegram, where buyers immediately feed them into credential stuffing tools.

Check If You Are Affected

HEROIC scans 400B+ exposed records across breach dumps, stealer logs, and dark web marketplaces. Run a free scan to see if your email or password appears in the ArtHouse Cloud drop, then follow the remediation steps to rotate credentials and lock down any exposed accounts.