ARTEX: a copycat Docker image adds a root backdoor to the AI pentest console

How it happened

The original author removed the GitHub repository on October 8. A copy under the account trhhubsd changed one line of docker-compose.yml to pull tomicdd/artex from Docker Hub. Badbyte says the image adds a function that runs, as root and before any credential check, a command sent in the login request's captcha field. The GitHub source does not contain the change. Who runs the tomicdd and trhhubsd accounts is not public.[1][2] Checked 8 Nov 2026

What was stolen

No theft is reported. Badbyte says a console holds API keys, target and scope data, harvested credentials, findings and intercepted traffic, all reachable by whoever holds the backdoor.[1] Checked 8 Nov 2026

Who was impacted

Badbyte saw 62 internet-facing consoles serving the backdoored build between November 2 and 4, out of 1,645 live ARTEX consoles, and calls 62 a floor. It counts about 9,000 pulls of the image and 637 GitHub repositories still pointing to it. Who runs these consoles is not known, and Badbyte reports no confirmed attack using the backdoor. Badbyte says Docker removed tomicdd/artex on November 5 at the researchers' request; copies already pulled stay backdoored.[1][2] Checked 8 Nov 2026

Threat actor

Not attributed. Unknown. Badbyte does not say who runs the tomicdd and trhhubsd accounts or whether they are the same person.

Timeline

1. 8 Oct 2026The original ARTEX author announces the project goes closed source and removes the repository. The same day the Docker Hub account tomicdd is created and pushes an ARTEX image, and the account trhhubsd uploads a copy of the source. [1]
2. 20 Oct 2026The first backdoored console is seen online. [1][2]
3. 4 Nov 2026Badbyte publishes its findings: 62 internet-facing consoles serving the backdoored build between November 2 and 4. [1]
4. 5 Nov 2026The Hacker News reports about 9,000 downloads of the image. Badbyte says Docker removes tomicdd/artex the same day. [1][2]