Analysts Find ArtHouse Cloud Logs Leak Exposed 33,085 Records

HEROIC threat analysts observed a stealer log file labeled "ArtHouse Cloud Logs v1" appear on Telegram in June 2026. Upon review, researchers confirmed the file contained 33,085 records, including email addresses, plaintext passwords, and the URLs tied to each login, all collected from infected devices.

What Analysts Found Inside the ArtHouse Cloud Logs Leak

According to HEROIC's review, the passwords in this file were stored in plain text, sitting directly alongside each matching email address and website. Researchers noted that this format requires no additional effort from an attacker. There is nothing to crack or decode, only data to copy and use.

What Was Exposed, as Documented by Analysts

• Email addresses
• Plaintext passwords
• URLs (the login pages tied to each account)

Why Researchers Say This Kind of Leak Matters

Analysts point out that leaked, reused passwords are frequently fed into automated tools that test them accross other websites, a method known as credential stuffing. When that happens, the consequences observed in similar cases include account takeover, identity theft, and financial fraud, often affecting victims who never suspected there original device was compromised.

How Researchers Say Stealer Logs Like This Get Made

Analysts explain that stealer malware typically spreads through cracked software, malicious ads, or phishing emails. Once active, it collects saved browser passwords and autofill data, then compiles everything into a log file. From there, files such as "ArtHouse Cloud Logs v1" are traded or given away on Telegram, which is where HEROIC first identified this one.

Check If You Are Affected

HEROIC recommends taking a moment to check your exposure. The company's free breach scanner compares your email address against a database of more than 400 billion leaked records, so you can find out quickly whether the ArtHouse Cloud Logs leak involved your information.