Our Analysts Found ArtHouse Cloud Logs Circulating on Telegram

Our analysts identified a stealer log circulating in a monitored Telegram channel on September 13, 2025. The file was labeled as ArtHouse Cloud Logs and contained 53,748 records of harvested credentials. What we found inside was a clean, organized dump of email addresses, plaintext passwords, and the URLs of sites victims were logged into when their devices were compromised. The way it was structured and distributed on Telegram matched the signature of several active stealer malware campaigns we had been tracking leading up to that date.

Why This Is Dangerous

When our team analizes stealer logs like this one, the immediate threat is obvious: plaintext passwords mean zero effort for the attacker. There is no hash to reverse, no algorithm to defeat. Every email and password pair is immediately usable. With 53,748 records, this is enough data to fuel a serious credential stuffing operation across dozens of platforms. The URL data adds another layer of risk because it tells attackers which specific services these users were authenticated to, allowing them to prioritize their attack attempts on the most valuable targets first.

What Was Exposed

• Email addresses from compromised user sessions
• Plaintext passwords captured directly by the stealer malware
• URLs revealing which sites and API hosts victims used
• 53,748 total records discovered on September 13, 2025

Why This Matters

Finding this file on Telegram rather than a dark web forum is significant. It signals that whoever distributed this log was optimizing for reach, not just profit. Public Telegram channels are accessible without any special software or membership, which means the potential pool of people who downloaded this data is much wider than a typical dark web post. That breadth of exposure substantially increases the likelihood that these credentials have already been tested against live accounts. The September 13 date also places this among several other ArtHouse Cloud logs from the same period, suggesting a coordinated or ongoing malware campaign targeting this ecosystem.

How Stealer Log Works

Stealer malware is typically distributed as a trojan hidden inside pirated software, cracked games, or fake utility tools. Once a user installs the infected program, the malware activates in the background, reading credential databases from Chrome, Edge, and Firefox without triggering obvious alerts. It collects session tokens, saved passwords, and browser history, then packages everything and sends it to a command-and-control server or directly to a Telegram bot. The attacker then sorts the logs by geography or service type and posts them publicly to attract attention or sell to other criminal operaters.

Check If You Are Affected

This ArtHouse Cloud Logs breach from September 13, 2025 has been added to the HEROIC breach database, which now contains over 400 billion exposed records. You can search your email address for free at heroic.com to see if your credentials appeared in this or any other known leak. If you are affected, change your passwords right away, enable two-factor authentication on all critical accounts, and check your device for signs of malware infection.