Dark Web Intel: 43,148 Credentials From the ArtHouse Cloud Logs v2 Dump on Telegram

What HEROIC Analysts Found in the ArtHouse Cloud Logs v2 Stealer File

HEROIC analysts identified a stealer log file uploaded to Telegram in February 2026 under the name ArtHouse Cloud Logs v2. This file is significantly larger than its predecessor, containing 43,148 records harvested from infected devices. Each record includes an email address, a plaintext password, and a URL showing which online service that person was accessing when their device was compromised. The v2 designation indicates this is a second batch from the same source, suggesting an ongoing and organized data collection operation.

Why 43,148 Leaked Records Make ArtHouse Cloud Logs v2 a High-Value Threat

Scale matters in credential theft. With over 43,000 working credential pairs, an attacker armed with this file can run automated credential stuffing campaigns against dozens of platforms simultaneously. The sheer volume increases the statistical certainty that at least some of these logins will succeed against banking portals, corporate email systems, cloud storage providers, and social media platforms.

The plaintext nature of the passwords means no decryption step is needed. Every email-password pair can be tested immediately. And because each record also includes a URL, attackers know exactly which platform to target first for each victim, making the attack far more efficient than blind credential stuffing.

What Was Exposed in the ArtHouse Cloud Logs v2 Upload

• 43,148 email addresses linked to active accounts
• Plaintext passwords captured directly from infected browsers
• URLs identifying the exact services and platforms each victim was using

Why ArtHouse Cloud Logs v2 Could Unlock Email, Banking, and Social Media Accounts

The data in ArtHouse Cloud Logs v2 does not just expose one account per victim. It creates a pathway through every service a person uses. Once an attacker accesses a primary email account, they can reset passwords on every platform that uses that email for account recovery. Banking apps, investment accounts, shopping platforms, and work accounts all become reachable through a single compromised inbox.

For a file of this size, the number of successful account takeovers that could result is substantial. Identity theft, financial fraud, and unauthorized account access are all realistic consequences. Victims whose data appears in this file almost certainly never recieved any notification that their credentials were captured and distributed on Telegram.

How the ArtHouse Cloud Logs Series Was Built and Distributed

The existence of both a v1 and v2 file under the ArtHouse Cloud brand suggests a structured data collection and distribution operation. Infostealer malware is deployed across multiple devices, the harvested data is aggregated into organized bundles, and the resulting files are uploaded to Telegram channels. The v2 file represents a later batch with significantly more records than the first, indicating the operation grew in scope between uploads.

These types of files are frequently posted in Telegram channels with subscriber counts in the thousands. Anyone who downloads the file has immediate access to all 43,148 credential pairs. The data spreads rapidly through reshares and secondary postings. By the time security researchers identify and catalog a file like this, it has typically already been downloaded hundreds of times. This is occured with both versions of the ArtHouse Cloud logs, and the adress of each victim's compromised service is fully visible to anyone who opens the file.

Check If You Appear in the ArtHouse Cloud Logs v2 Dataset

HEROIC's free breach scanner covers more than 400 billion exposed records, including large Telegram stealer log bundles like ArtHouse Cloud Logs v2. With 43,148 records in this single file, the chances of finding a match are not small. Run a free scan at HEROIC with your email address and find out immediately whether your credentials are circulating on the dark web.