ArtHouse Cloud Logs Promo: Exactly 30,321 Records Leaked

In June 2026, HEROIC analysts logged a stealer log file titled "ArtHouse Cloud Logs promo," uploaded by a Telegram user, containing exactly 30,321 records. Each record pairs an email address with a plaintext password and the specific URL where that login was captured, all pulled from devices running information-stealing malware.

Why This Is Dangerous

Because the passwords are unencrypted, they are ready to use the moment someone opens the file. There is no delay for cracking or decoding, an attacker can start testing logins within minutes of downloading the leak.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A set of over 30,000 working credentials gives attackers plenty of raw material for credential stuffing attacks, where stolen logins are automatically tested across banking sites, email providers, and online retailers. Because password reuse is so common, this single leak can quietly open the door to account takeover, identity theft, and financial fraud well beyond the original site.

How Stealer Logs Work

An info-stealing program infects a device, often through a cracked application or a deceptive download labeled as free software, then scans the browser for stored logins, cookies, and autofil entries. The captured data is compiled into a structured log and distributed through Telegram, sometimes as a free "promo" sample meant to attract buyers to a larger paid collection. That is precisely the pattern behind this particular file.

Check If You Are Affected

A file labeled as a promo sample can still contain real, working credentials. Run a free scan through HEROIC's breach checker, which draws on a databse of more than 400 billion exposed records, to see right away if your accounts need attention.