ArtHouse Cloud Logs v2 Quietly Surfaces 6,679 Stolen Credentials

In March 2026, HEROIC analysts verified a second stealer log release tied to ArtHouse Cloud infrastructure, catalogued as ArtHouse Cloud Logs v2. An anonymous Telegram user shared the file publicly, and it contained 6,679 records with email addresses, plaintext passwords, and endpoint URLs. This release followed closely behind v1 and represents a continued pattern of credential exposure from the same source environment.

Why ArtHouse Cloud Logs v2 Warrants Attention

The data in this file is straightforward and immediately usable. Email addresses and plaintext passwords together form a complete login credential. There is no technical barrier between a criminal downloading this file and gaining access to someone's account. The endpoint URLs included in each record tell an attacker not just who the victim is, but which specific platform to try the credential against.

Because this file is a continuation of the ArtHouse Cloud log series, some individuals affected by v2 may also appear in v1. Overlapping exposure across multiple stealer log releases means a single person's credentials could appear in circulating datasets more than once, increasing the likelihood that their accounts are targeted.

What Was Exposed in ArtHouse Cloud Logs v2

• Email Addresses: Login identifiers tied to cloud services, business platforms, and personal accounts
• Plaintext Passwords: Unencrypted passwords ready to use without any additional processing
• URLs: Specific service endpoints and API addresses captured during active sessions

Why This Matters: Credential Reuse and Cascade Risk

Most people reuse passwords. That single habit turns one exposed credential into a skeleton key. When attackers get a plaintext email and password combination, they run automated tools that systematically test those credentials across hundreds of popular platforms. Banking sites, email providers, social media, online shopping accounts, all of them become potential entry points from a single compromised record.

Beyond individual account takeover, breaches like this one carry risks of finantial fraud, where attackers redirect transactions or drain stored credit. For business users, a compromised cloud service URL combined with working credentials could expose company data, customer records, or internal communication channels. These outcomes are not hypothetical. They follow predictably from the kind of data exposed here.

How Infostealer Malware Produces Logs Like This

Infostealer malware is purpose-built to extract credentials from an infected device without the user noticing. These programs are lightweight, fast, and designed to avoid detection. They typically gain access through phishing campaigns, bundled software installers, or browser extension scams.

Once running, an infostealer silently reads saved passwords stored in the browser, captures any session tokens currently active, and records the web addresses associated with those sessions. The compiled log is transmitted to the attacker, often within minutes of infection. The resulting file, sometimes just a few megabytes, contains everything neccessary to impersonate the victim across multiple platforms.

Logs like the ArtHouse Cloud v2 file are then packaged and distributed, either sold or shared freely on Telegram channels where threat actors congregate. Once distributed, they can remain in active use for months or years.

Find Out If ArtHouse Cloud Logs v2 Includes Your Credentials

HEROIC's breach database indexes more than 400 billion records from stealer logs, data dumps, and combolists. A free search will tell you whether your email address or password appeared in the ArtHouse Cloud Logs v2 release or any other known breach dataset.

If your data is found, change the relevant passwords immediately and enable two-factor authentication wherever it is supported. Visit HEROIC's breach scanner now to check your exposure.