ArtHouse Cloud Logs v2 Leak Exposes 79,917 Cloud Passwords

HEROIC analysts uncovered a large stealer log dump named ArtHouse Cloud Logs v2, uploaded to a Telegram channel on June 21, 2026. This is one of the largest files in this batch, containing 79,917 records, each one pairing an email address with a saved website URL and its plaintext password.

Why Cloud and SaaS Accounts Are Especially at Risk Here

The name of this log points directly at cloud based tools, the kind of software people log into every day for work, storage, and creative projects. Stealer logs branded around "cloud" accounts tend to carry a heavy mix of logins for file storage services, design platforms, project management tools, and other subscription software.

That is a problem because business and creative professionals often keep client files, financial records, and unpublished work sitting behind these same logins. A leaked cloud account is not just a password, it can be a doorway into someone's entire workflow.

What Was Exposed

• Email addresses
• Plaintext passwords
• Saved website URLs tied to cloud and web based logins

Why This Matters

With 79,917 plaintext credentials in circulation, criminals have an enormous supply of ready to use logins. They routinely feed lists like this into automated credential stuffing tools, testing each email and password against banking sites, email providers, and other cloud platforms. Because the passwords are not encrypted, there is no extra barrier slowing them down, wich makes account takeover, identity theft, and financial fraud much faster to carry out.

How Stealer Log Breaches Like ArtHouse Cloud Logs v2 Happen

Infostealer malware often spreads through cracked design software, fake plugin downloads, or phishing emails aimed at freelancers and small businesses who rely heavily on cloud tools. Once the malware runs, it quietly harvests every saved password and cookie in the browser, then packages the results into a single log file, occuring often without the victim ever noticing.

Because so many creative and cloud service accounts share the same browser on one device, a single infection can hand attackers dozens of connected logins at once, which is likely how this file grew to nearly 80,000 records.

Check If You Are Affected

If you use cloud storage, design tools, or other subscription software, it is worth checking whether your credentials appear in ArtHouse Cloud Logs v2 or a similar leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you exactly where your information has surfaced. Run a free scan today and change any exposed password right away.