One Telegram File. 116,162 Records. The ArtHouse Cloud Logs Dump From August 2025
On August 8, 2025, a single Telegram post quietly surfaced containing a file labeled ArtHouse Cloud Logs. No fanfare, no announcement. Just a compressed archive dropped into a public channel. Inside that file were 116,162 records, each one representing a real person's email address, plaintext password, and the URL where that password was used. For a file with such an unassuming name, the contents were remarkably damaging.
Why This Is Dangerous
The combination of plaintext passwords and specific API host URLs is what separates this leak from a generic credential dump. Most breaches expose hashed passwords that require cracking before they are usable. This one skipped that step entirely. Every password in the ArtHouse Cloud Logs file is ready to use as-is. Add the API host information, and attackers have a direct map to backend services, internal systems, and cloud infrastructure access points. That kind of data doesn't just enable account takeovers. It enables infrastructer compromise.
What Was Exposed
- 116,162 total records from compromised endpoints
- Email addresses for each compromised account
- Plaintext passwords requiring no cracking or decryption
- URLs revealing the exact services and sites targeted
- API host information pointing to backend and cloud access points
Why This Matters
At over 116,000 records, this is not a small dump. The scale suggests the infostealer behind this log ran across a large number of devices, possibly as part of a coordinated campaign. Stealer logs with API host data are particularly valued in underground markets because they offer a shortcut into cloud services and developer environments, not just user accounts. If any of the compromised credentials belonged to developers or system admins, the downstream impact could extend far beyond the individuals listed in the file. Corporate systems, staging environments, and cloud storage buckets could all be reachable from data in a log like this.
How Stealer Logs Work
Infostealers are a specialised category of malware that silently harvest credentials from infected machines. Common delivery methods include phishing emails with malicious attachments, fake software downloads from counterfeit sites, and compromised browser extensions. Once active on a device, the malware scans saved browser passwords, email and FTP client credentials, and any session tokens it can find. It also monitors keyboard input in real time. All of that gets packaged into a structured log file and sent to a remote server. The operator then sorts, sells, or distributes the logs, often through Telegram channels like the one where ArtHouse Cloud Logs first appeared in August 2025.
Check If You Are Affected
With 116,162 records in this single file, the chances of exposure are real. Heroic.com has indexed over 400 billion leaked records from data breaches and stealer logs around the world. You can search your email address right now for free to see if your credentials have appeared in this breach or any other. It only takes a few seconds and the results will tell you exactly what was exposed and where it came from.
Breach Breakdown
116,162 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)