Severity: High | Priority: 1
ARTEX is an open-source, AI-driven penetration-testing framework that can run full attack chains with little human input. After it was used in real-world intrusions, its developer removed the official repository, and copies quickly appeared elsewhere. In one widely used copy, someone changed a single line so that the tool installs a container image from an attacker-controlled Docker Hub account rather than building it from source. The image is backdoored. It has been downloaded around 9,000 times, a second account republished an identical copy, and hundreds of public code repositories still point to it. Between 2 and 4 November 2026, at least 62 ARTEX consoles exposed to the internet were found running the backdoored build.
The backdoor sits inside the console’s login function. When someone submits a login request carrying an extra captcha field that starts with a secret marker, the console runs the rest of that field as a system command with root privileges and returns the output. It does this before checking any username or password, so the attacker needs no account and no valid credentials, only network access to the console. The backdoor makes no outbound connections and simply waits for requests, so it is hard to spot from outbound traffic.
The consequences go well beyond the container. An ARTEX console stores everything an offensive-security team uses and gathers: AI model and search API keys, database and JWT signing keys, tool and integration tokens, email and proxy credentials, and the targets, captured credentials, findings and intercepted traffic from every engagement. Anyone with access can steal all of it, or quietly change the tool’s agents, prompts and integrations to turn it against its own operators or their clients. CERT-In has separately warned that ARTEX and similar AI-assisted tools are being used in an active campaign against Indian banking, financial services and insurance organisations, and against cryptocurrency exchanges.
Teams that run ARTEX should stop any container built from the tomicdd/artex or congdonglinux/artex images immediately, and block access to the console port until each instance is checked. Install only a verified official release, pinned by its image digest rather than the “latest” tag, and correct any compose files that point to the trojanized image. Treat every instance that ran the backdoored build as fully compromised. Rotate every credential and key it held, review its stored agents, prompts, tools and integrations for unauthorised changes, and inform any clients whose engagement data it contained. Do not expose offensive-security consoles directly to the internet: place them behind a VPN or restrict them to trusted IP addresses.