Dark Web Intel: 31,660 Credentials From ArtHouse Cloud Logs v2

HEROIC analysts identified a stealer log titled "ArtHouse Cloud Logs v2 uploaded by a Telegram User" that surfaced on Telegram on 04-Aug-2026. The file contains 31,660 records harvested directly from infected devices, pairing each victim's login URL with their email address and plaintext password.

Why This Is Dangerous

Unlike a password an attacker has to guess, the credentials in a stealer log are copied straight out of a victim's browser or saved password manager by malware running on their device. That means whoever has this file does not need to guess anything: they get the exact website, the exact email address, and the exact password the victim actually uses, ready to log in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites and services those credentials unlock

Why This Matters

Because stealer logs hand over working login pairs, they are often used for direct account takeover rather than slower guesswork. With 31,660 records in this single file, a large number of people risk having their email, shopping, or other online accounts accessed by someone else, especially if they reused the same password across multiple sites.

How Stealer Logs Work

Stealer logs come from malware built to quietly harvest data from an infected computer, most often the passwords saved in web browsers along with autofill data and site cookies. Once collected, the malware sends everything back to the attacker as a single package, which then gets labeled (in this case "ArtHouse Cloud Logs v2", a follow-up batch to an earlier version of the same log) and shared through Telegram channels and dark web forums.

Check If You Are Affected

If you think your credentials could be part of this or a similar leak, use HEROIC's free breach scanner to check your email address against a database of more than 400 billion breached records. It takes seconds and can tell you whether it's time to change a password.