Identity Theft Risk Grows: ArtHouse Cloud Logs v1 Hits 20,512

On July 28, 2026, HEROIC analysts identified a stealer log named "ArtHouse Cloud Logs v1" uploaded to a Telegram channel, the first in a series that also includes a later "v3" batch. This file contains 20,512 records harvested from infected devices, including endpoints, email addresses, API hosts, and plaintext passwords. Why this is dangerous: as the earliest version in this series, "v1" likely represents the initial batch of credentials collected by the malware behind it. With 20,512 plaintext passwords paired with email addresses and the exact hosts they connect to, an attacker has a direct, ready-to-use path into each affected account. What was exposed in ArtHouse Cloud Logs v1: API hosts and endpoints, email addresses, and plaintext passwords. Why this matters: the risk of identity theft, financial fraud, and account takeover grows every time a stealer log like this one circulates, especially as it gets copied, resold, and redistributed across Telegram channels. Anyone whose credentials appear in "v1" is also at risk if their same password protects other, unrelated accounts, since attackers routinely test stolen logins across multiple sites. How stealer log malware works: stealer malware infects a device through phishing emails, fake software installers, or malicious downloads, then scans for saved passwords, browser sessions, and the addresses those credentials belong to. The data is compiled into a log, in this case the first of what became a multi-part "ArtHouse Cloud Logs" series, and shared or sold to other criminals on Telegram. Check if you are affected: because this data is recent and part of an ongoing series, it's worth checking your exposure sooner rather than later. HEROIC's free breach scanner checks your email against more than 400 billion leaked records so you can see if you're affected and secure your accounts.