32300 Records: ArtHouse Cloud Stealer Logs

HEROIC analysts identified a stealer log labeled ArtHouse Cloud Logs uploaded to a public Telegram channel on November 13, 2024. The file contained 32,300 records pulled from infected devices in the United States, including email addresses, plaintext passwords, and the URLs those credentials unlock.

Why This Is Dangerous

Because every password in this file sits in plaintext, all 32,300 of them are ready to use the instant someone downloads it. Each entry already pairs an email with the exact site its password opens, so an attacker skips straight past any need to guess or crack.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to the affected accounts

Why This Matters

Credentials like these are exactly what attackers use for credential stuffing, automatically testing stolen email and password pairs against banking, shopping, and email platforms. A reused password can turn this leak into account takeover, financial fraud, or identity theft.

How Stealer Logs Work

A stealer log comes from malware that quietly infects a device, copies saved browser passwords along with the sites they unlock, and sends everything back to the attacker. That data is packaged into a file and shared on Telegram channels, which is how this ArtHouse Cloud Logs file came to light.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a free scan today and change any passwords you have reused elsewhere.