The 4,423 Passwords Sitting Inside ArtHouse Cloud Logs v2

Zoom in on just one detail from ArtHouse Cloud Logs v2, uploaded the same day as its predecessor on April 27, 2026, and it's this: the record count jumped from 1,796 in v1 to 4,423 here, more than doubling in a single version step.

Why This Is Dangerous

A growth curve like that tells you the underlying infection campaign was working. Whatever malware fed data into this series was reaching more devices between v1 and v2, and that momentum, more than the raw number itself, is what should concern anyone tracking this particular threat.

What Was Exposed

• 4,423 email addresses matched with plaintext passwords
• The exact URLs where each stolen credential still applies
• A record count more than double the previous version in the same series

Why This Matters

Every version in this series shares the same risk profile, plaintext passwords with zero protection, but the fact that v2 grew so much faster than expected means the people relying on this malware had every incentive to keep going, occassionally scaling their infrastructure to catch even more victims. There was clearly no reason for them to stop after seeing these results.

How a Stealer Log Series Scales This Fast

Rapid growth between versions usually means the malware distribution method, whether phishing emails, fake downloads, or malvertising, started reaching a wider audience, and victims rarely recieve any indication their browser data was just harvested. More infected devices simply means more harvested credentials per export cycle, and a series that doubles in size between v1 and v2 is a strong signal the campaign was accelerating rather than winding down.

Check If You Are Affected

If a leak series can more than double in size overnight, there's no gaurantee it stops growing after v2 either. HEROIC's free scanner checks your information against more than 400 billion breached records, covering this entire ArtHouse Cloud Logs series so you don't have to track each version by hand.