Inside ArtHouse Cloud Logs: How Stealer Malware Harvested 434 Passwords

HEROIC analysts identified the ArtHouse Cloud Logs stealer log breach in February 2026, when a Telegram user uploaded a log file containing 434 compromised records. The exposed data included email addresses, plaintext passwords, and the specific URLs where those credentials were used. Despite the relatively small record count, this breach is significant because the passwords are in plaintext and ready for immediate exploitation on any service where the affected users reuse their credentials.

Why This Is Dangerous: What Attackers Can Do With ArtHouse Cloud Logs Data

The ArtHouse Cloud Logs file gives attackers a direct window into real accounts at real websites. With email addresses matched to plaintext passwords and the URLs of those accounts, criminals can attempt login immediatly on the listed services. Cloud service accounts are a particularly high-value target because they often contain file storage, business data, and access to connected applications. A single compromised cloud account can expose far more than just one person's files.

What Was Exposed in the ArtHouse Cloud Logs Breach

• Email Addresses
• Plaintext Passwords
• URLs (the specific websites and services targeted)

Why This Matters: Stealer Logs and the Account Takeover Chain

Stealer log data is among the most immediately usable breach data available to cybercriminals. Unlike hashed password dumps that require cracking, stealer logs deliver working credentials on a silver platter. Attackers run these credentials through automated tools in a process called credential stuffing, attempting logins across banking apps, email services, and cloud platforms. Victims can face account takeover, identity theft, and financial fraud often before they ever recieve a notification that something is wrong.

Inside Stealer Logs: How Infostealer Malware Harvests Cloud Passwords

Infostealer malware specifically targets the kind of data exposed in the ArtHouse Cloud Logs breach. When installed on a victim's device, the malware searches browser password stores, application credential managers, and session cookies. It identifies cloud service logins in particular because these often grant long-term access through saved sessions. The malware bundles every harvested credential with the URL it belongs to, creating a ready-to-use attack kit. These kits are then sold or freely shared on Telegram channels. The ArtHouse Cloud Logs name likely refers to the specific Telegram channel or toolkit used to compile and distribute the data. Users who store cloud credentials in their browsers are definitaly at higher risk of appearing in logs like this one.

Check If You Are Affected

HEROIC's free breach scanner searches over 400 billion exposed records including stealer logs like ArtHouse Cloud Logs. If your email appeared in this file, your cloud account passwords should be changed immediately and two-factor authentication should be enabled. Scan your email now at HEROIC to find out before someone else logs in as you.