{"id":"CMP-202611-3clfry","kind":"campaign","aliases":[],"related":[],"title":"Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shell on servers running the AI hacking tool","description":null,"summary":"After ARTEX's developer pulled the AI pentest framework from GitHub, a copy at github.com/trhhubsd/ARTEXX (2,449 stars, 600+ forks) changed docker-compose.yml to pull the Docker Hub image tomicdd/artex (about 9,000 pulls). Its login handler has a hidden verifyCaptcha() routine: a CAPTCHA value starting with a secret marker runs as root via sh -c before any credential check. congdonglinux/artex is identical. 62 internet-facing ARTEX consoles served the backdoored build from 2 to 4 Nov 2026, the first by 20 Oct 2026 (26 US, 17 Hong Kong, 7 China). Found by researcher Badbyte and reported by The Hacker News. Whether anyone has used the backdoor is unknown, but anyone holding it gets the instance's targets, findings, credentials and sessions.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ARTEX","fixed":[],"package":"tomicdd/artex","ecosystem":"Docker Hub"},{"name":"ARTEX","fixed":[],"package":"congdonglinux/artex","ecosystem":"Docker Hub"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for ARTEX deployments whose docker-compose.yml or running containers use the image tomicdd/artex or congdonglinux/artex, or were cloned from github.com/trhhubsd/ARTEXX (also check mhtsec/ARTEX = mianhuatang11/artex and RuoJi6/ARTEX copies). In the login handler code, look for a verifyCaptcha() function that passes the CAPTCHA field to sh -c. In login endpoint logs, look for odd CAPTCHA values. Other 'artex' images on Docker Hub (autumn26, andy1099zz, dgddw, trhhubsd, ylh440104, mianhuatang11) are unvetted, and the source does not say whether they are backdoored. The secret marker string is unknown.","fix":"Stop and isolate any ARTEX instance built from these images or copies, and take it off the internet. Treat the host and everything the instance held as compromised: rotate the credentials, sessions and API keys stored in it or reachable from it, and rebuild the host. Do not run unvetted ARTEX copies, and never expose the console publicly or run it as root.","status":"open","published_at":null,"first_seen_at":"2026-11-05T09:11:41+00:00","triaged_at":"2026-11-05T09:11:41+00:00","updated_at":"2026-11-05T09:11:43+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':20A '-3':21A '/trhhubsd/artexx':48B '000':65B '17':120B '2':49B,107B '20':115B '2026':111B,117B '26':118B '4':109B '449':50B '600':52B '62':96B '7':123B '9':64B 'ai':16A,38B 'anyon':7A,136B,144B 'artex':2A,23A,26A,27A,33B,100B 'backdoor':1A,24A,104B,140B 'badbyt':128B 'build':105B 'c':88B 'campaign':28B 'captcha':76B 'chang':54B 'check':92B 'china':124B 'clfry':22A 'cmp':19A 'congdonglinux/artex':93B 'consol':101B 'copi':44B 'credenti':91B,153B 'develop':35B 'docker':3A,59B 'docker-compose.yml':55B 'earli':30B 'early-warn':29B 'face':99B 'find':152B 'first':113B 'fork':53B 'found':125B 'framework':40B 'get':147B 'github':42B 'github.com':47B 'github.com/trhhubsd/artexx':46B 'give':6A 'hack':17A 'hacker':133B 'handler':69B 'hidden':72B 'hold':145B 'hong':121B 'hub':60B 'ident':95B 'imag':4A,61B 'instanc':149B 'internet':98B 'internet-fac':97B 'kong':122B 'login':68B 'marker':82B 'news':134B 'nov':110B 'oct':116B 'pentest':39B 'pull':36B,57B,66B 'report':130B 'research':127B 'root':10A,85B 'routin':74B 'run':14A,83B 'secret':81B 'serv':102B 'server':13A 'session':155B 'sh':87B 'shell':11A 'star':51B 'start':78B 'target':151B 'tomicdd/artex':5A,25A,62B 'tool':18A 'unauthent':9A 'unknown':142B 'us':119B 'use':138B 'valu':77B 'verifycaptcha':73B 'via':86B 'warn':31B 'whether':135B","nicknames":["ARTEX backdoor","tomicdd/artex"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["artex","artexbackdoor","tomicddartex"],"ptokens":["artex"],"labels":["aitooling","campaign","critical","earlywarning"],"campaign_type":"supply-chain","first_public_at":"2026-11-05T08:42:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-3clfry","url":"https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T09:11:41+00:00","fetched_at":"2026-11-05T09:11:41+00:00","note":null,"cites":["https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html"]}],"documents":[{"id":74627,"url":"https://x.com/TheHackersNews/status/2118263059991134550","title":"@TheHackersNews: ‼️ A backdoored AI hacking tool is exposing servers to root access without authe","kind":"post","source":"x","publisher":null,"text":"‼️ A backdoored AI hacking tool is exposing servers to root access without authentication.\n\nA malicious Docker image for ARTEX hides a root shell in its login handler.\n\nResearchers found 62 internet-facing consoles running the backdoored build.\n\nRead: https://t.co/JiUtfukLWG\n\nlikes 34 reposts 12","published_at":"2026-11-05T08:44:03+00:00","relation":"describes","confidence":null,"note":null},{"id":74818,"url":"https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html","title":"Backdoored Docker Image for ARTEX AI Hacking Tool Exposes Servers to Root Access","kind":"blog","source":"analyst","publisher":null,"text":"The Hacker News (Ravie Lakshmanan), citing researcher Badbyte: after ARTEX's developer took the repo off GitHub, copies appeared (github.com/trhhubsd/ARTEXX, github.com/mhtsec/ARTEX, github.com/RuoJi6/ARTEX). The trhhubsd copy (2,449 stars, 600+ forks) changed one line in docker-compose.yml to pull Docker Hub image tomicdd/artex (9,000 pulls), which adds a hidden verifyCaptcha() in the login handler: if the CAPTCHA field starts with a secret marker, the rest runs via sh -c as root before any credential check. congdonglinux/artex is identical and also backdoored. Other artex namespaces: mianhuatang11, autumn26, andy1099zz, dgddw, trhhubsd, ylh440104 (not stated as backdoored). 62 internet-facing consoles served the backdoored build 2-4 Nov 2026; first by 20 Oct 2026, 12 days after image push; 26 US, 17 Hong Kong, 7 China; 1,645 ARTEX consoles total as of 4 Nov. Also: CERT-In reports AI-assisted actor Crafty Falcon targeting Indian BFSI using ARTEX, PentAGI, Cairn, CyberStrikeAI.","published_at":"2026-11-05T08:42:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}