FHN 
Cybersecurity researchers have identified a malicious Docker image associated with the ARTEX AI-assisted penetration testing framework that allows attackers to obtain unauthenticated root access to affected servers.
The backdoor was discovered in a modified ARTEX Docker image distributed through Docker Hub. According to independent researcher Badbyte, the malicious code was inserted into the application’s login handler, allowing attackers to execute operating system commands without valid credentials.
Hidden Backdoor in the Login Handler
The compromised image, identified as tomicdd/artex, contains a hidden verifyCaptcha() function.
When a specially crafted value is supplied through the CAPTCHA field, the function executes the remaining input using sh -c with root privileges. This happens before the application performs its normal credential verification.
As a result, an attacker who can reach the exposed login interface can execute commands on the affected system without authenticating.
The modified Docker image reportedly received approximately 9,000 downloads, increasing the potential exposure of organizations that deployed it.
62 Internet-Facing Consoles Identified
Researchers identified 62 ARTEX consoles running the backdoored build between November 2 and 4, 2026.
The exposed instances were distributed across multiple regions:
- United States: 26 instances
- Hong Kong: 17 instances
- China: 7 instances
Separately, researchers identified 1,645 hosts serving ARTEX consoles as of November 4. This broader figure does not mean all those systems were running the compromised image.
Multiple Copies Found Across GitHub and Docker Hub
The investigation also identified several copied ARTEX repositories and Docker images distributed through different accounts.
Some of these copies were found to reference the compromised image, while others require separate verification. The incident demonstrates how modified software repositories and untrusted container images can introduce hidden backdoors into legitimate security tools.
Security Recommendations
Organizations that have deployed ARTEX should:
- Check Docker configurations and running containers for affected images.
- Identify and remove compromised containers and images.
- Rebuild deployments using verified and trusted sources.
- Rotate credentials, API keys and secrets accessible to affected systems.
- Review server logs for suspicious login requests and unexpected root-level command execution.
- Restrict access to security testing consoles and avoid exposing administrative interfaces publicly.
The incident highlights the risks of deploying unverified Docker images, particularly security tools that operate with elevated privileges or have access to sensitive credentials and network environments.
About the Author
