Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shell
ARTEX AI penetration-testing console, Docker images tomicdd/artex and congdonglinux/artex
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
After the author of ARTEX, an open-source AI penetration-testing console abused in attacks on banks, took the GitHub repository down on Oct 8 2026, a copycat repository (trhhubsd/ARTEX, the most-starred copy) changed one line in docker-compose.yml to pull a Docker Hub image, tomicdd/artex, pushed the same day. BadByte found that the image's binary, unlike the clean GitHub source, adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check. The image had 7,946 pulls by Nov 3 (about 9,000 by Nov 5), 637 GitHub repositories still pointed their compose file at it, and 62 internet-facing consoles served the backdoored build between Nov 2 and 4. congdonglinux/artex is a byte-identical re-push. If you ran either image, treat the host and every key in the container (database password, LLM and search API keys, harvested target credentials, JWT signing key) as compromised, rebuild from reviewed source and keep the console off the open internet.
Why this severity: Unauthenticated root command execution on every install of the trojanized image; about 9,000 pulls and 62 exposed backdoored consoles seen
- Started
- Oct 8, 2026
Affected
- tomicdd/artex:latest (index digest sha256:ce85d8369ccc1a85423f1f75d2f3afaa2fab759e580da37a6891af2f7392745e)
- congdonglinux/artex:latest (same digests)
- Any compose file pointing at tomicdd/artex, including trhhubsd/ARTEX and its forks such as imxv/ARTEXX
Fixed in
- No fix for the trojanized image: stop it, treat the host as compromised and rebuild from reviewed source; BadByte found other third-party ARTEX images it checked clean
Timeline5
The Hacker News reports the backdoor alongside a CERT-In warning about AI-assisted attacks on Indian financial firms using tools including ARTEX; tomicdd/artex is at about 9,000 pulls.
BadByte publishes its analysis: 7,946 pulls, 637 repos still pulling the image, 62 backdoored consoles seen (46 still live) and 1,645 ARTEX consoles online.
Dan Tentler (Viss) reports on Mastodon that the Docker image, not the GitHub code, is backdoored, via the captcha system.
First backdoored ARTEX console visible on the internet; congdonglinux/artex registered with the identical image.
ARTEX's author says the tool was abused, takes the GitHub repo down; that evening Docker Hub account tomicdd is created, pushes tomicdd/artex, and trhhubsd swaps the compose image to it.
News & write-ups2
Posts2
‼️ A backdoored AI hacking tool is exposing servers to root access without authentication. A malicious Docker image for ARTEX hides a root shell in its login handler. Researchers found 62 internet-facing consoles running the backdoored build. Read: t.co/JiUtfukLWG
🚨 We dug into the backdoored ARTEX Docker image. • 7,946 pulls of tomicdd/artex • 637 repos still pull it • 62 exposed consoles backdoored, 46 still live • 1,645 ARTEX consoles exposed across the internet Full write-up 👇 t.co/AoB3dc8bEM
Notes & caveats
BadByte says the backdoor is only in the prebuilt tomicdd/artex binary (sha256 d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573, UI build ID 3aC1db3gGU08O4UHbAt4J), not in any public source, and that 62 is a floor because 590 more consoles run unversioned builds it could not tell apart from outside. Its Detection section has commands to check your own install. Related: the WorkOS breach, where the attacker used ARTEX.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
