ArtHouse Cloud Logs v3 Was Stolen Weeks Before It Went Public

The infection that created the ArtHouse Cloud Logs v3 dataset happened weeks before anyone knew about it. Devices were compromised, credentials were harvested, and the data sat in an attacker's hands, then it all appeared at once on Telegram on September 13, 2025. By that point, 49,149 people had already had their email addresses and plaintext passwords collected without ever knowing it happened. That gap between when data is stolen and when it becomes publicly known is one of the most understated dangers in cybersecurity today.

Why This Is Dangerous

The v3 designation on this log suggests it is a third installment in a series, which points to an ongoing and organized malware distribution effort rather than a one-time event. Recurring uploads from the same source typically indicate a stealer being actively maintained and deployed against new targets over time. Each record in this 49,149-entry file includes a plaintext password, so anyone who downloaded the file from Telegram got a ready-to-use credential list with no additional work required. The timeline delay between infection and public disclosure is also dangerous because it gave attackers weeks of exclusive access before any defenses could be put in place.

What Was Exposed

• Email addresses from compromised user endpoints
• Plaintext passwords extracted by the stealer malware
• URLs identifying which services victims were logged into
• 49,149 total records made public on September 13, 2025

Why This Matters

What makes the ArtHouse Cloud Logs v3 upload notable is the timeline. This version shares its leak date with other ArtHouse Cloud logs, hinting at a batch release strategy where an attacker dumps multiple log files at once to maxamize coverage and impact. Each file targets a slightly different slice of victims, but together they form a much larger credential exposure event. If you had your device infected by this malware campaign at any point during September 2025, your data may appear in one or more of these logs. The v3 label also implies earlier versions exist, meaning this campaign was well-established long before it became public.

How Stealer Log Works

Version-numbered stealer logs like this one often correspond to iterative updates to the malware itself or to organized batches from an ongoing infection campaign. The malware infects devices through the usual vectors such as phishing emails, fake software cracks, and malicious ad downloads. Once running, it systematically drains browser-stored credentials, captures session cookies, and records the active URLs associated with each saved login. The compiled logs are then labeled and versioned by the attacker for distribution, either for sale or as free uploads intended to build reputation within criminal communities on Telegram and similar platforms.

Check If You Are Affected

HEROIC tracks breaches like ArtHouse Cloud Logs v3 across a database of more than 400 billion exposed records. The September 13, 2025 leak has been indexed and is searchable right now at heroic.com. Enter your email address to find out if your credentials were caught in this or any related ArtHouse Cloud log dump. If you show up in results, update your passwords immediately, activate two-factor authentication, and run a full malware scan to remove any lingering infection from your device.