Search Your Email: The ArtHouse Cloud Logs Exposed 24,778 Accounts

What HEROIC Analysts Found

In early August 2026, HEROIC analysts identified a stealer log file labeled "ArtHouse Cloud Logs v1," uploaded to a Telegram channel. The file contained 24,778 records pulled from malware-infected devices, including email addresses, plaintext passwords, and the URLs of the sites those logins belong to.

Why This Is Dangerous

Stealer logs like this one capture credentials directly from an infected device, meaning the passwords are exactly what the victim typed in, stored in plain, readable text. Paired with the matching site URL, anyone who gets this file has an immediate, ready-to-use login for each account listed.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A recently harvested stealer log like this one is especially risky because the credentials are current, not years old, making it more likely they still work. Since infostealer malware typically grabs everything saved in a browser at once, one infected device can expose logins to email, banking, shopping, and social accounts all at the same time, opening the door to credential stuffing across all of them.

How Stealer Logs Work

A stealer log is the output of infostealer malware, a program that quietly runs on an infected device and collects saved browser passwords, autofill details, and site information before sending it all back to the attacker in one file. These logs, labeled here as version "v1," are often shared or sold on Telegram shortly after being harvested.

Check If You Are Affected

Search your email now to find out if it appears in this leak or any other. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you know exactly which passwords need to change.