ArtHouse Cloud USA Logs Mean Someone Could Be in Your Accounts

Imagine waking up to a password reset email you never requested, or finding out your work account sent spam to your entire contact list overnight. That is the kind of scenario that plays out when a stealer log goes public on Telegram. On September 17, 2025, a Telegram user dropped a file containing 109,137 records from what is labeled ArtHouse Cloud USA. These are real email addresses paired with the actual passwords people were using when their devices got infected. Someone could be logging into your accounts right now.

Why This Is Dangerous

The size of this particular log, over 100,000 records, puts it in a category that serious threat actors pay atention to. Larger logs attract buyers and automated tools that systematically test credentials across hundreds of platforms at once. Because the passwords are in plaintext, there is zero delay between downloading the file and attempting logins. The associated URL data tells attackers exactly which services these users cared about, letting them skip the guesswork and target the right platforms first. This is not theoretical risk, it is the exact workflow attackers follow every day.

What Was Exposed

• Email addresses from U.S.-based ArtHouse Cloud USA users
• Plaintext passwords harvested from infected devices
• URLs indicating which services and API hosts victims were accessing
• 109,137 total records leaked on September 17, 2025

Why This Matters

With 109,137 records, this is one of the larger ArtHouse Cloud stealer log releases. The US-specific targeting suggests the malware campaign may have been designed to hit American users disproportianately, possibly to access services more prevalent in the US market. Plaintext password exposure at this volume means thousands of people are vulnerable to account takeover right now, and most of them have no idea. Password reuse is extremely common, so even if users change their ArtHouse Cloud password, every other site where they used the same credentials remains at risk until they take action.

How Stealer Log Works

Stealer malware enters devices through deceptive means like fake software updates, pirated games, or phishing links in emails. Once active, it silently scans the file system and browser storage for saved credentials, session tokens, and autofill entries. All harvested data gets compressed into a log archive and exfiltrated to the attacker, often within minutes of infection. The attacker then sorts the logs by country or service and uploads them to Telegram channels where other criminals can download and exploit them. The whole pipeline from infection to credential sale can take less than 24 hours.

Check If You Are Affected

HEROIC monitors breach data across more than 400 billion exposed records, including this ArtHouse Cloud USA stealer log from September 2025. Search your email address at heroic.com to find out if your credentials were part of this leak. If they were, update your passwords on every site that shared those credentials, turn on two-factor authentication, and scan your devices for malware. Acting fast is the best way to get ahead of whoever downloaded this file.