One Telegram Post. Three Data Types. ArtHouse Cloud Logs Had 68,523 Records.

HEROIC analysts monitoring dark web activity on September 22, 2025, detected a stealer log file posted to a public Telegram channel by an anonymous user. The file was tied to the ArtHouse Cloud Logs service and contained 68,523 records. This is the largest single ArtHouse Cloud dump in our dataset by record count, and it stood out immediately due to the combination of email addresses, plaintext passwords, and API endpoint URLs -- all bundled together in a format that requires no technical skill to exploit. Our team began analyzing the dataset structure and correlating the exposed credentials against our breach intelligence index within the same monitoring cycle.

Why This Is Dangerous

A file containing over 68,000 plaintext credentials is ready-made ammunition for credential stuffing operations. Threat actors who obtained this Telegram post can run automated login attempts across major platforms immediately, without any preprocessing. The API host URLs embedded in the records go one step further -- they identify the precise services each victim was authenticated to, which allows attackers to skip lower-value targets and aim directly at corporate portals, financial platforms, and cloud infrastructure. The combination of scale and plaintext format makes this one of the more actionable credential leaks we have documented from this campaign.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (API hosts and accessed service endpoints)

Why This Matters

With 68,523 exposed credential pairs, the potential for cascading account takeovers is significant. Credential stuffing tools can cycle through thousands of login attempts per hour, meaning attackers can test this entire dataset across multiple platforms in a matter of days. Victims who reuse passwords across personal and professional accounts face exposure on multiple fronts simultaneously. Financial fraud, unauthorized wire transfers, and identity theft are all realistic outcomes for individuals whose credentials are in this dataset. For enterprises, a single compromised employee account can serve as the entry point for ransomware deployment or data exfiltration. The fact that this data was posted publicly -- not sold privately -- suggests the goal was maximum distribution rather than targeted exploitation.

How Stealer Log Breaches Work

Stealer logs are produced by a class of malware known as infostealers, which are sold as subscription services on cybercriminal forums. After infecting a device, the malware scans browser credential stores, autocomplete data, saved form entries, and application authentication tokens. It bundles everything into a structured log and sends it to the attacker's collection server. The ArtHouse Cloud Logs label likely refers to the cloud service infrastructure where the compromised sessions were active. Attackers then distribute these logs publicly on Telegram to demonstrate reach, build credibility, or simply flood the market. The September 22 upload date and the unusually high record count -- 68,523 -- suggest this log may have been aggregated from multiple separate infection campaigns, a definately common tactic among stealer operators to inflate log volume and perceived value. The inclusion of API URLs alongside each credential pair is a characteristic of more sophisticated collection frameworks that log the full HTTP session context, not just the username and password.

Check If You Are Affected

If you used any ArtHouse Cloud service before September 2025, your account credentials may appear in this 68,523-record dataset. HEROIC's breach intelligence database covers over 400 billion records and provides instant lookup by email address. Visit heroic.com to check your exposure for free. If your credentials are found, change your password on every account using the same combination, revoke any active API tokens associated with your email address, and enable two-factor authentication to block future unauthorized access attempts.