The ArtHouse Cloud Logs Put 6,859 Email and Password Pairs Online

"ArtHouse Cloud Logs" Stealer Log Exposes 6,859 Records

HEROIC analysts identified a stealer log file labeled "ArtHouse Cloud Logs" that surfaced on a Telegram channel on July 26, 2026. The file contained 6,859 records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. The file was posted openly in the channel, giving anyone who found it immediate access to the data.

Why This Is Dangerous

Because this data was harvested directly from infected devices rather than pulled from a hacked company server, the passwords are stored in plaintext instead of hashed. Paired with the matching URL for each account, an attacker can go straight to the correct login page and try each of these 6,859 credential pairs without any extra work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters

If any of these 6,859 people reused their password on other accounts, an attacker can use credential stuffing to try that same login on email, banking, or social media platforms. That can quickly lead to account takeover, identity theft, and financial fraud for anyone whose credentials appear in this file.

How Stealer Logs Work

A stealer log is created when malware, often hidden inside a cracked program, fake download, or malicious attachment, infects a device and quietly collects everything saved in the browser: usernames, passwords, autofill data, and browsing history. That data is packaged into a log file, labeled with a name like "ArtHouse Cloud Logs," and uploaded to Telegram channels where anyone can access it.

Check If You Are Affected

If you think your email might be part of this or any similar leak, HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records. It takes seconds to check and gives you a clear next step.