Inside ArtHouse Cloud Logs v2: How Malware Harvested 120,696 Passwords

Inside ArtHouse Cloud Logs v2: 120,696 Records Exposed

On June 16, 2025, HEROIC analysts identified a stealer log labeled "ArtHouse Cloud Logs v2" uploaded to a public Telegram channel. The file contained 120,696 records harvested from infected devices, including email addresses, plaintext passwords, and the URLs of the sites those credentials unlocked. This is one of the largest single stealer log uploads HEROIC has tracked, and it offers a clear look at how malware turns individual infections into a mass credential dump.

Why This Is Dangerous

Because the passwords in this log are stored in plaintext and paired with the exact web address each one unlocks, an attacker does not need to crack or guess anything. They can simply match an email address to its password and the site it belongs to, then log in directly as the account owner. With 120,696 records in a single file, the scale of potential account takeover is enormous.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Every one of the 120,696 exposed records represents a working login somewhere on the internet. If any of those people reused their password for email, banking, or social media, an attacker now has a path into those accounts too. This is exactly how credential stuffing attacks succeed: automated tools take leaked email and password pairs and test them against dozens of other websites until one works, leading to account takeover, identity theft, or financial fraud.

How Stealer Logs Work

A stealer log is the output of information stealing malware, malicious software that quietly infects a device and scans browsers, saved logins, and autofill data for anything resembling a credential. The malware runs silently in the background, capturing usernames, passwords, and browsing URLs as the victim types them in, then transmits everything back to whoever controls the infection. That data is then bundled into a single file, in this case one labeled "ArtHouse Cloud Logs v2," and distributed through channels like Telegram, sometimes sold and sometimes given away for free. Because the malware captures credentials the moment they are typed, even a strong, unique password will not protect an account if the device itself is infected.

Check If You Are Affected

To find out if your email address appears in this leak or any other stealer log, use HEROIC's free breach scanner, which checks your information against a database of more than 400 billion leaked records. Run a free scan today, and if you find a match, change the affected password immediately and avoid reusing it anywhere else.