ArtHouse Cloud Logs v3 Leak Exposes 51,870 Cloud Login Credentials

HEROIC analysts found a stealer log file called "ArtHouse Cloud Logs v3" uploaded to a Telegram channel on January 25, 2025. The file contains 51,870 records harvested directly from infected devices, including email addresses, plaintext passwords, and the URLs of the cloud services and API endpoints those credentials unlock.

Why This Is Dangerous

The URLs in this leak point directly to the services and login pages tied to each stolen password, and because the passwords are stored in plaintext, no cracking or decoding is needed. An attacker can pair each email with its matching password and URL and log straight into cloud accounts and services within minutes of downloading the file.

What Was Exposed in the ArtHouse Cloud Logs v3 Leak

• Email addresses
• Plaintext passwords
• URLs of the associated cloud services and API endpoints

Why This Matters

When login credentials for cloud services and online accounts leak in plaintext, attackers can automate the process of trying them across other websites, a technique known as credential stuffing. Anyone who reused one of these passwords elsewhere risks having those accounts taken over too, which can quickly escalate into identity theft and financial fraud if banking or email accounts are among them.

How This Stealer Log Was Created

A stealer log is the output of malware that infects a device and quietly harvests saved passwords, browser autofill data, and active login sessions before sending everything back to whoever controls the malware. Because it comes directly from the victim's own computer or phone, the captured passwords appear in plaintext exactly as they were typed or saved. Files like "ArtHouse Cloud Logs v3" are then packaged and shared or sold through Telegram channels, exactly where HEROIC analysts located this one.

Check If You Are Affected

If you want to know whether your email address appears in this leak or any other, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan now and change any password you may have reused.