HEROIC Analysts Find ArtHouse Cloud Logs v2 Stealer Log Leak

HEROIC analysts uncovered a stealer log dated 31 Jul 2026 named ArtHouse Cloud Logs v2 while reviewing recent Telegram uploads from an individual user. The file is one of the larger ones we have found in this series, containing 18,523 records of email addresses, plaintext passwords, and the URLs each credential belongs to.

Why the ArtHouse Cloud Logs v2 Leak Is Dangerous

With 18,523 sets of plaintext credentials in one file, an attacker does not need to crack a single password, only read it. Each record already includes the matching email and the exact URL of the site it opens, which is enough to log in directly.

What Was Exposed in ArtHouse Cloud Logs v2

• Email addresses
• Plaintext passwords
• URLs of the sites tied to each login

Why a Leak This Size Matters to Everyone in It

At more than 18,000 records, this leak is large enough for attackers to automate the next step: feeding every email and password pair into other services through credential stuffing to see which ones still work. That is how a single stolen login on one obscure site turns into account takeover, identity theft, or financial fraud on accounts the victim actually cares about.

How Our Analysts Found ArtHouse Cloud Logs v2

HEROIC's team continuously monitors Telegram channels and dark web forums where stealer logs are shared, which is how ArtHouse Cloud Logs v2 was flagged shortly after it appeared. Files like this are produced by malware that harvests saved browser credentials from infected devices, then get versioned and reuploaded, as the "v2" in the name suggests, once enough new data has been collected.

Check If You Are Affected by ArtHouse Cloud Logs v2

With over 18,000 records in this leak alone, it is worth taking a minute to check. HEROIC's free breach scanner searches your email against more than 400 billion leaked records, including stealer logs like this one, so you can confirm your exposure and secure any affected accounts right away.