ArtHouse Cloud Logs v2: 27,749 Passwords Exposed. Yours Could Be One.

HEROIC analysts identified a stealer log named "ArtHouse Cloud Logs v2" uploaded to a Telegram channel on July 28, 2026. The file contains 27,749 records of email addresses, plaintext passwords, and URLs, including endpoints and API hosts, all pulled directly from infected devices. Why This Is Dangerous: The "v2" in the file name means this is at least the second batch collected under the same campaign, suggesting the malware behind it has been actively harvesting credentials for a while. Because the passwords are in plaintext, they are usable the moment someone downloads the file, with no cracking required. What Was Exposed: - Email addresses - Plaintext passwords - URLs and API endpoints tied to the stolen logins Why This Matters: If your device was ever infected by the malware behind this log, your saved passwords, including ones for email, banking, or work accounts, could be sitting in this file right now. Even if you were not directly infected, reused passwords mean one leaked credential from this batch can be tried against your other accounts, opening the door to account takeover, identity theft, and financial fraud. How a Stealer Log Like This Works: Infostealer malware infects a device through a malicious download, cracked software, or a phishing link, then quietly scans the browser for saved passwords, cookies, and autofill data, including logins to cloud services and APIs. The malware bundles everything by infected machine and uploads it to the attacker, who releases it in batches, hence the "v2" label, and distributes it through Telegram channels like the one this file surfaced on. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out in seconds if your credentials were exposed.