NEW ArtHouse Cloud Stealer Log Breach: 17,604 US Records

NEW ArtHouse Cloud: 17,604 Records and a Two-Batch Oct 5 Operator Profile

When an operator releases two batches on the same day under the same brand -- one labeled simply "ArtHouse Cloud" and one labeled "NEW ArtHouse cloud" -- it tells you something about their distribution strategy. The "NEW" designation in Telegram stealer log channels typically signals one of three things: a refreshed collection from a more recent harvest window, a geographicly distinct credential set within the same broader operation, or an updated version of a previous release with additional records appended. At 17,604 records, NEW ArtHouse cloud is the larger of the two Oct 5 ArtHouse batches, making it the primary release with the original batch potentially serving as an earlier preview or subset.

NEW ArtHouse Cloud (October 2023): Stealer Log Summary

• Records Exposed: 17,604
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 5, 2023

ArtHouse Cloud + NEW ArtHouse Cloud: A 31,342-Record Pair

Together, the two Oct 5 ArtHouse batches account for 31,342 US stealer log credentials. This combined footprint is larger than most individual operators in the Oct 5 dataset and would rank solidly in the mid-tier of Oct 6 non-MC contributors. The pairing follows a structural pattern seen elsewhere in this dataset: an operator releases an initiall batch as a freemium promotional sample, then follows up with a larger "NEW" release to demonstrate continued output and attract additional channel subscribers. The plaintext passwords in both batches are immediately actionable, and their combined attack surface -- 31,342 email-password-URL triplets targeting US endpoints -- represents a substantial credential stuffing resource.

October 5 as a Precursor to October 6

The October 5 releases -- including both ArtHouse batches, CRYPTON_LOGS 2.0 (11,972), and SNATCH_CLOUD 353PCS (6,490) -- collectively add tens of thousands of records to the dataset in the 24 hours before the massive Oct 6 surge. The presence of multiple operators releasing on Oct 5 and Oct 6 in quick succession is consistent with a competitive Telegram marketplace dynamic, where channels monitor each other's release activity and accelerate their own publishing to capture subscriber attention during peak activity windows. Whether ArtHouse Cloud is the same operator as any Oct 6 channel is unknown, but the temporal proximity is striking.

17,604 Credentials: The Immediate and Ongoing Risk

NEW ArtHouse cloud's 17,604 records consist of plaintext passwords captured from US-based endpoints by infostealer malware. These credentials were published on a public Telegram channel in October 2023 and have been accessible to anyone who subscribed since that date. The exploitation timeline for stealer log credentials is front-loaded -- the most agressive credential stuffing campaigns typically hit within 24-48 hours of a leak. But credentials from these batches remain usable for as long as the affected users haven't changed their passwords, which means the risk doesn't expire on any particular date.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including NEW ArtHouse cloud's Oct 5 collection and its companion ArtHouse Cloud batch. If your credentials are in either of the two Oct 5 ArtHouse releases, HEROIC's index will find them. Run a free scan at HEROIC's breach scanner today.