How Malware Led to 196,463 Stolen Logins in ARCEUSULP 2

In June 2026, HEROIC discovered a massive stealer log labeled ARCEUSULP 2 222255 being distributed on Telegram. The file tells a grim story: infostealer malware running across thousands of infected devices silently captured login credentials, compiled them into this 196,463-record dataset, and delivered them to threat actors. Every record contains an email address, a plaintext password, and the URL where the credential was used—a complete blueprint for account takeover at industrial scale.

Nearly 200,000 Passwords in Plaintext

Every one of the 196,463 passwords in this dump appears in plaintext. There is no hashing, no salting, no encryption. These are the actual passwords users typed, available for immediate use by anyone who downloads the file. At this scale, the exposure represents a significant threat to individuals, organizations, and online services alike.

What Was Exposed

• Email Addresses — nearly 200,000 unique accounts across countless platforms
• Plaintext Passwords — unprotected credentials ready for mass exploitation
• URLs — the specific services and websites tied to each compromised login

Credential Stuffing at Industrial Scale

A dataset of 196,463 credential pairs is extraordinarily valuable to attackers running credential stuffing campaigns. These records will be systematically tested against banking portals, email services, corporate VPNs, cloud platforms, and social media networks. Given that a substantial percentage of users reuse passwords, tens of thousands of additional accounts beyond this initial dataset are likely at risk of compromise.

Tracing the Infostealer Malware Chain

The ARCEUSULP 2 dump was assembled from infostealer malware infections spanning a large number of devices. The malware—likely variants like RedLine, Raccoon, or Vidar—infiltrated systems through phishing emails, malvertising, and trojanized software. Once installed, it extracted saved credentials from every browser and application on each infected machine. The harvested data was structured into organized logs and funneled through command-and-control infrastructure before being uploaded to Telegram for widespread distribution.

Check If Your Credentials Were Exposed

With nearly 200,000 records in a single dump, the chances of your information being included are real. HEROIC's breach scanner provides access to more than 400 billion indexed records. Search your email address or domain to determine whether your credentials appear in the ARCEUSULP 2 leak or any other known data breach. Act immediately on any matches—change passwords, enable multi-factor authentication, and monitor your accounts for suspicious activity.