Inside ARCEUSULP 167 Stealer Logs: 369,091 Passwords Harvested

HEROIC identified a stealer log archive labeled ARCEUSULP 167 being distributed through Telegram channels. Analysis confirmed 369,091 unique records containing login credentials stolen from infected endpoints by infostealer malware. Each record pairs an email address with a plaintext password and the URL of the service it was extracted from.

The Plaintext Password Threat

Passwords in this leak are stored in plaintext rather than a hashed format. This means every credential is immediately readable and usable by any threat actor who obtains the file. There is no decryption step, no brute-force computation needed. Plaintext exposure represents the worst-case scenario for password security because it eliminates every technical barrier between an attacker and your account.

What Was Exposed

• Email Addresses — personal and corporate accounts tied to compromised logins
• Plaintext Passwords — fully readable credentials requiring zero additional processing
• URLs — the exact websites and services where stolen credentials were captured

How Credential Stuffing Amplifies the Damage

Once these credentials enter circulation, attackers deploy automated tools to test each email-password pair against banking portals, email providers, shopping sites, and streaming services. This technique, called credential stuffing, succeeds at alarming rates because most people reuse passwords. A single valid pair from the ARCEUSULP 167 dump can cascade into compromised accounts across dozens of unrelated platforms.

Understanding Infostealer Malware

Stealer logs like ARCEUSULP 167 are produced by infostealer trojans that run silently on infected machines. These programs target browser password managers, autofill data, cookies, and even cryptocurrency wallets. Infection vectors include malicious email attachments, fake software downloads, and compromised ads. The malware extracts stored credentials and transmits them to command-and-control servers, where they are packaged into logs and sold or shared on underground forums.

Check If Your Credentials Were Exposed

HEROIC has indexed the ARCEUSULP 167 stealer log into its breach intelligence database, which now exceeds 400 billion compromised records. Run a free scan with HEROIC's breach checker to see if your email or password appears in this dataset. Identifying exposed credentials early allows you to reset passwords and enable multi-factor authentication before attackers gain access.