The Docker Image Behind a Popular AI Attack Tool Has a Root Shell Built Into Its Login Page. 62 Consoles Were Serving It, and the Tool's Original Repository Is Gone.
If you or anyone on your team installed ARTEX from a GitHub copy or from Docker Hub, check which image your docker-compose file pulls. If it pulls tomicdd/artex or congdonglinux/artex, that image carries a hidden remote root shell in its login handler. Take the console off the network, treat the host as compromised, and rotate anything it could reach. The Hacker News, reporting researcher Badbyte's findings, says 62 consoles serving the backdoored build were found between November 2 and 4.
What happened
ARTEX is a free AI-driven attack framework. We covered it earlier this week (https://www.dugganusa.com/post/artex-off-the-rack-vapor-panda-crowdstrike): CrowdStrike reported one operator using it against more than 200 organizations, and every way in was old. The original developer later pulled the repository from GitHub after the tool was misused in real intrusions. That left a gap, and copies filled it.
According to The Hacker News, copies appeared on GitHub and Docker Hub. One GitHub copy, listed as trhhubsd/ARTEX (the report also spells it ARTEXX), had 2,449 stars and more than 600 forks, per Badbyte. That copy changed one line in its docker-compose.yml so that the console would pull an image called tomicdd/artex from Docker Hub instead of building from source.
How the backdoor works
The image adds a hidden function to the console's login handler. If the CAPTCHA field begins with a secret marker, the rest of the input is run as a root shell command, and the output comes back in the response. This happens before any credential check. The result is an unauthenticated root shell on every install. Badbyte says it would not show up in a normal code review, since the change is one added function inside a login path no one expects to read.
Docker Hub reports about 9,000 downloads of tomicdd/artex. A second namespace, congdonglinux/artex, is described as identical and also backdoored.
How many were exposed
Badbyte found 62 ARTEX consoles serving the backdoored build between November 2 and 4: 26 in the United States, 17 in Hong Kong and 7 in China. The first instance appeared by October 20, twelve days after the image was pushed. As of November 4, 1,645 hosts were serving an ARTEX console. The report does not say how many of those run the backdoored build, so 62 is a count of confirmed ones, not a ceiling.
Which image names to check
Other Docker Hub namespaces also publish images called artex: mianhuatang11, autumn26, andy1099zz, dgddw, trhhubsd and ylh440104. The report names tomicdd and congdonglinux as the backdoored ones. It does not say the others are clean. We have not pulled or inspected any of these images, so we cannot say. If you run one, verify it before trusting it.
The report also lists these GitHub copies: mhtsec/ARTEX (Docker Hub mianhuatang11/artex) and RuoJi6/ARTEX, and says the first two GitHub repositories are no longer downloadable.
The part that has nothing to do with this backdoor
The same Hacker News article covers a CERT-In advisory about an AI-assisted actor it calls Crafty Falcon, targeting banking, financial services and insurance firms in India. CERT-In names ARTEX, PentAGI, Cairn and CyberStrikeAI among the public tools it uses, and describes access through exposed applications and APIs, stolen long-lived tokens, forged commits in source repositories, and small test transactions of one rupee before large transfers. The advisory IDs are CIAD-2026-0058 and, for an earlier alert, CIAD-2026-0046.
The report does not connect the two. It does not say Crafty Falcon used the backdoored builds, or that the 62 consoles are its infrastructure. We are placing them next to each other because the same tool is in both, not because the evidence joins them.
Why this one stings
Attackers are now the ones pulling unvetted software from Docker Hub and running it as root on an internet-facing port. The tool is a free, public, AI-driven framework, and the people who want it are people who will not read the source. Badbyte's own comment, as relayed, is that unvetted tools should not run as root on exposed ports. A defender who runs these tools in a lab for testing has the same exposure.
What to do
If your compose file pulls tomicdd/artex or congdonglinux/artex, stop the container and take the host off the network.
Assume anything the host could reach was reachable by whoever sent the marker: keys, tokens, cloud credentials, other containers. Rotate them.
Search egress and web logs on the host for login requests with unusual CAPTCHA values. We do not have the marker, and neither does the report, so you cannot match it directly.
Pin images by digest and read what you run before it runs as root.
The Docker-specific cleanup steps are our reading of the situation. The report gives no formal mitigation.
What is not known
The secret marker. Image digests. Any IP address or domain the backdoor calls out to, if it does. Who published tomicdd and congdonglinux, and whether anyone has used the shell against a console. How many of the 1,645 hosts are backdoored. The report lists no network indicators, hashes or digests, and we found none elsewhere, so there is nothing to put in the feed from this story. Image names are not blocklist entries, and we did not ingest them.
Limits
One secondary report of Badbyte's research. We did not read Badbyte's own write-up or CERT-In's advisories, whose text the article does not reproduce, and we did not pull, run or inspect any image. The counts, dates and download figure are as reported. Our own earlier post on ARTEX is the CrowdStrike story, which is a different matter from this backdoor.
Five percent of this is wrong somewhere. It always is. A second look at the images by someone who can run them will correct the namespace list.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments