ArtHouse Cloud v1 uploaded by a Telegram User

We noticed a recent upload to a public Telegram channel on February 10th, 2025, containing a substantial log file originating from what appears to be a compromised instance of "ArtHouse Cloud v1." What struck us immediately was the inclusion of plaintext passwords alongside email addresses and API host URLs, a configuration that significantly lowers the barrier for subsequent credential stuffing or direct account compromise. The sheer volume of records, exceeding 146,000, suggests a widespread impact, potentially affecting a significant portion of the user base or a large dataset within the ArtHouse Cloud ecosystem. The method of exfiltration, through a stealer log, points towards a malware-driven compromise rather than a direct web application vulnerability, which has implications for our incident response and threat hunting strategies.

The breach, identified via a stealer log file uploaded by an anonymous Telegram user, exposed 146,993 records. Analysis of the leaked data reveals a concerning mix of sensitive information: email addresses, plaintext passwords, and associated API host URLs. The source structure indicates the data was exfiltrated from endpoints running "ArtHouse Cloud v1," suggesting a compromise at the application or endpoint level, likely facilitated by malware designed to harvest credentials and configuration details. The direct availability of plaintext passwords is the most critical threat vector, enabling immediate unauthorized access to associated accounts and services. The leak location, a public Telegram channel, amplifies the risk by making this data readily accessible to malicious actors globally.

While specific news coverage regarding the "ArtHouse Cloud v1" compromise is currently limited, the nature of stealer logs appearing on Telegram is a well-documented phenomenon in cybersecurity circles. Threat intelligence reports frequently detail the repurposing of these logs by various cybercriminal groups for credential stuffing, identity theft, and further network infiltration. Research into prevalent infostealer malware families, such as RedLine or Raccoon Stealer, often highlights their capability to target cloud service credentials and API keys, aligning with the observed data types in this incident. The OSINT landscape for such leaks is dynamic, with dedicated forums and channels serving as marketplaces for compromised data, making continuous monitoring essential.