Dark Web Intel: 60,500 Credentials Found in ArtHouse Cloud Logs v3

On 04-Aug-2026, HEROIC analysts identified a stealer log named ArtHouse Cloud Logs v3 circulating on Telegram. The file contains 60,500 records pulled from infected devices, each with an email address, a plaintext password, and the URL of the login it belongs to.

Why This Is Dangerous

With 60,500 working logins captured straight from compromised devices, an attacker has an enormous head start; there's no password cracking involved, only a list of ready-to-use credentials matched to their exact login pages. The "v3" in the file name suggests this is at least the third version of this log, meaning the group behind it has been collecting and reselling this kind of data repeatedly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for each affected login

Why This Matters

A dataset of this size increases the odds that your information is included, especially if you have ever saved passwords in a browser on a device that later got infected. If your credentials are among these 60,500 records, the same password may unlock other accounts you own, making credential stuffing attacks a real threat.

How Stealer Logs Work

Stealer logs come from information-stealing malware that silently harvests saved browser passwords, autofill data, and session details from an infected device. Groups running these operations at scale often package and rebrand their output under a recognizable name, like "ArtHouse Cloud Logs," releasing updated versions such as this v3 batch as new infections roll in.

Check If You Are Affected

With 60,500 records in circulation, checking your exposure only takes a moment. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this stealer log, so you can find out and change any compromised passwords right away.