ArtHouse COMBO URL CLOUD_part_0025 Leak Exposes 12M Passwords

On 14-Jul-2026, HEROIC analysts found a massive stealer log circulating on Telegram, labeled "ArtHouse COMBO URL CLOUD_part_0025." The file contains a staggering 12,043,772 records tied to United States users, pairing email addresses with plaintext passwords and the exact URLs those credentials open.

Why This ArtHouse Combo Cloud Leak Is Dangerous

Twelve million records is not a small side project, it's an industrial-scale collection built for automated abuse. At this size, an attacker doesn't sift through the file by hand, they load it into software that tests every email, password, and matching URL in rapid succession. Because each login is already paired with the exact site it works on, there's no wasted effort, every entry in the file is a ready-to-use attempt on a real account.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

Because the passwords are stored in plaintext, they work immediately, with no cracking required. A file of this size is prime material for credential stuffing at scale: attackers systematically try each email and password pair against banking sites, email providers, and online stores far beyond the original source. Anyone among the 12,043,772 exposed records who has reused a password elsewhere faces a real risk of account takeover on accounts that have nothing to do with this specific leak.

How Stealer Logs Work

A stealer log is built by malware that infects a device, silently harvests every username, password, and site address saved in the browser, and sends it back to whoever is running the malware. A single infected computer can yield logins for dozens of unrelated services, and when many infected devices are combined into one "combo cloud," the result is a file that can run into the millions of records. These bulk collections are then shared or sold on platforms like Telegram, where they circulate quickly among anyone looking for working logins.

Check If You Are Affected

With over 12 million records in this one file, the odds that an average internet user is included are not trivial. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including massive stealer logs like this one, and tells you right away if your information has surfaced. If it has, changing that password immediately and enabling two-factor authentication is the fastest way to shut attackers out.