The ArtHouse CLoud Logs v1 Dump: 22,991 Stolen Credentials Hit Telegram

HEROIC analysts identified the ArtHouse CLoud Logs v1 stealer log breach in February 2026, when a Telegram user uploaded a file containing 22,991 stolen records. The exposed data was harvested by malware running silently on infected devices, capturing login credentials, email addresses, and URLs before they were transmitted to threat actors operating on Telegram channels.

Why This Is Dangerous

Stealer logs are among the most actionable data sets available to cybercriminals. Because the credentials were captured directly from infected machines, attackers recieve working, real-time login pairs rather than old or hashed passwords. With plaintext passwords and matching email addresses in hand, bad actors can immediately attempt to access banking portals, email accounts, social media platforms, and corporate systems. The included URLs reveal exactly which sites the victim had active sessions on, giving attackers a ready-made target list.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

When plaintext passwords and email addresses appear together in a breach, the risk is definately compounded. Attackers use automated tools to try these credential pairs across hundreds of popular services in a technique called credential stuffing. A single compromised account can lead to account takeover across multiple platforms, identity theft, unauthorized purchases, and financial fraud. Victims often have no idea their credentials were stolen until damage has already occured.

How Stealer Logs Work

Stealer logs are created by a category of malware known as information stealers, or infostealers. Once a device is infected -- typically through a malicious download, phishing link, or software crack -- the malware runs quietly in the background. It scans the device for saved passwords in browsers, active login sessions, autofill data, and clipboard content. All of this is bundled into a compressed log file and sent back to the attacker. These logs are then sold or shared on dark web forums and Telegram channels, making stolen credentials widely available within hours of infection.

Check If You Are Affected

If your email address or passwords were part of the ArtHouse CLoud Logs v1 stealer log, you may not know until an attacker has already used your credentials. HEROIC offers a free dark web scanner that searches across more than 400 billion exposed records to check whether your information has been compromised. Run a free scan today and find out if your data is already in the hands of cybercriminals.