Researchers Link ArtHouse Cloud Logs v2 to 43,076 Stolen Logins

HEROIC analysts have linked a dump called "ArtHouse Cloud Logs v2" to 43,076 exposed records, uploaded to Telegram in August 2026. Unlike a combolist, this is a stealer log collection, meaning the data was harvested directly from infected computers rather than assembled from old breach data.

Why This Is Dangerous

Stealer logs are considered more dangerous than typical combolists because the malware that generates them captures whatever was active on the victim's device at the time of infection, including saved browser passwords and the exact web addresses they belong to. With 43,076 records in this batch, the "v2" label suggests it is one of a series of related dumps from the same source.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for each captured login

Why This Matters

Because stealer logs capture live, currently-used credentials rather than old leaked passwords, the accounts in this dump are especially likely to still be active. That raises the risk of account takeover, and any reused password extends the danger to other accounts the victim owns through credential stuffing.

How Stealer Logs Like This Get Created

Stealer malware infects a device, often through a pirated download, cracked software, or a malicious email attachment, then quietly copies saved passwords, browser cookies, and autofill data before sending it back to the attacker. Criminals then package these logs by infection batch, such as this "Cloud Logs v2" set, and sell or trade them on Telegram.

Check If You Are Affected

Search HEROIC's free breach scanner, which checks your email against more than 400 billion leaked records, to see if you appear in this stealer log, and run an antivirus scan on your devices as a precaution.