en
ArtHouse CloudArtHouse_Cloud_TeamCSArtHouseCloudStealer (also known as ArtHouse Cloud and ArtHouse_Cloud_Team) is an aggregate profile of information-stealer traces. As of 07/11/2026, CyStack's research records 2 variants distributed through 1 channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
CSArtHouseCloudStealer is a CyStack-coined identifier for the
heavily-stripped ArtHouse Cloud System.txt log observed inside
@ft7links-distributed packs alongside canonical Lumma content
and the CSBabaStealer rebrand. The body wraps an
XFiles-derivative victim-info block in two ArtHouse Cloud
banners (header + footer) framed with U+2500 box-drawing
horizontal rules. The @ft7links operator labels the archive
lumma and resells multiple panels under one cover.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| ar******** | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
2 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
98ef534... | 1 | High |
d429c12... | 1 | High |
💎Buy: <value> ❗️Actual Link: <value> IP: <value>Country: <value>Operating System: <value>Username: <value>Computer Name: <value>CPU (Processor): <value>
