Inside New ArtHouse Cloud v2: How Malware Harvested 45,315 Passwords

HEROIC analysts identified a stealer log posted to a Telegram channel on January 22, 2025, cataloged as "New ArtHouse Cloud v2." The file contained 45,315 records harvested directly from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

A stealer log is different from a typical hacked database because the passwords inside it are never hashed or encrypted. They are captured in plaintext straight from the victim's browser, already paired with the exact website each one logs into. That means an attacker does not need to crack anything. They can simply copy the email, password, and URL combination and try it immediately.

What Was Exposed in the New ArtHouse Cloud v2 Log

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters for the 45,315 Records Involved

Because the credentials in this log are ready to use, they create an immediate risk of account takeover for anyone affected. If a password in this log matches one used elsewhere, attackers can attempt credential stuffing across email providers, banks, and shopping accounts, turning one infected device into a gateway for identity theft and financial fraud.

How a Stealer Log Like This One Is Built

Stealer logs are the output of infostealer malware, a type of program that installs quietly on a victim's computer through a pirated file, fake update, or malicious attachment. Once active, it searches the browser's saved logins and autofill data, then compiles every username, password, and URL it finds into a single file. That file, in this case labeled "New ArtHouse Cloud v2," is then uploaded to Telegram or dark web forums where it can be sold, traded, or given away, exactly as happened here in January 2025.

Check If You Are Affected

If you have used a device that may have been compromised, it is worth confirming whether your credentials appear in this or another leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly and change any exposed passwords before they are used against you.