ArtHouse Cloud Logs: 95,884 Plaintext Passwords Exposed on Telegram

HEROIC analysts identified a stealer log file uploaded to Telegram on April 17, 2025, exposing 95,884 records tied to the source labeled ArtHouse Cloud Logs. The dataset includes email addresses, plaintext passwords, and URLs that appear to be API host endpoints, the kind of data malware harvests directly from an infected device rather than from a single hacked company database.

Why This ArtHouse Cloud Logs Leak Is Dangerous

Because the passwords in this leak were stored in plaintext, anyone who obtains the file can log in immediately with no cracking or guessing required. Paired with the exposed API host URLs, the data could let an attacker connect directly to backend services tied to those accounts, not just the accounts themselves. That combination turns a simple credential leak into a potential doorway for further intrusion.

What Was Exposed in the ArtHouse Cloud Logs Leak

• Email addresses
• Plaintext passwords
• URLs (API host endpoints)

Why This Matters

Stealer logs like this one are a favorite tool for account takeover because the credentials are already validated, they came straight from a working login session. If you reused any of these passwords on other sites, attackers can attempt credential stuffing across email, banking, and social media accounts. Exposed email addresses also become prime targets for follow-up phishing designed to look convincing because the attacker already knows real account details.

How Stealer Log Leaks Like This Happen

A stealer log is the output of infostealer malware that infects a device, quietly collects saved browser passwords, autofill data, and session details, then sends everything back to the attacker. Rather than being sold immediately, many of these logs are dumped or shared for free on channels like Telegram, where anyone can download and use them. That is exactly the pattern seen here: a single anonymous upload containing tens of thousands of harvested credentials in one file.

Check If You Are Affected

If you think your email or login details could be part of this or any other leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion exposed records. Run a scan to see if your credentials have surfaced in this or another breach, and update any reused passwords right away.