ArtHouse Cloud Logs v3: 14,738 Passwords Exposed on Telegram

On July 28, 2026, just days ago, HEROIC analysts identified a stealer log named "ArtHouse Cloud Logs v3" uploaded to a Telegram channel. The file contains 14,738 records harvested from infected devices, including endpoints, email addresses, API hosts, and plaintext passwords. Why this is dangerous: because this log surfaced only days ago, the credentials inside are likely still active and unchanged by the people they belong to. Combined with the endpoint and API host details captured by the malware, an attacker has both the login and the exact destination to use it against. What was exposed in ArtHouse Cloud Logs v3: API hosts and endpoints, email addresses, and plaintext passwords. Why this matters: a fresh stealer log like this one is more dangerous than an older leak because the odds that passwords have already been changed are lower. With 14,738 records to work through, attackers can run credential stuffing at scale or target specific cloud and API endpoints identified in the data, potentially leading to account takeover, financial fraud, or further compromise of connected systems. How stealer log malware works: stealer malware infects a device through phishing links, cracked software, or malicious downloads, then silently collects saved passwords, browser sessions, and the exact hosts or services those credentials connect to. This particular batch, labeled "v3," suggests it's the third version or wave of logs from the same source, repackaged and uploaded to Telegram for distribution. Check if you are affected: because this log is so recent, it's worth checking your exposure now rather than later. HEROIC's free breach scanner checks your email against more than 400 billion leaked records so you can see if your information appears and secure any accounts before someone else gets there first.