Fake copy of a hacking tool gave strangers full control of 62 servers

Someone altered a copy of ARTEX, a free security testing tool, so that a stranger could take over any computer running it without a password. The altered version was downloaded 9,000 times from Docker Hub, a site where developers share ready-made software. Researchers found 62 exposed control panels, called consoles, running the tampered build between November 2 and 4, 2026.

What happened

ARTEX is open-source, meaning anyone can use it. Security teams use tools like it to test their own defenses. Attackers have also used it, and its developer took the original down from GitHub, a code-sharing site. Copies then appeared to fill the gap.

One copy, called trhhubsd/ARTEX, was starred 2,449 times and copied over 600 times. It changed a single line of a setup file so that installers pulled a different package, tomicdd/artex, from Docker Hub. That package hid a secret door in the login page.

How the trap works

According to researcher Badbyte, a hidden function checks the CAPTCHA field on the login page. If the text starts with a secret marker, the rest runs as a command with root access, the highest level of control, before any password check. Badbyte says it never shows up in a code review. A hacked console could also expose the findings and passwords it holds, and let attackers quietly change what the tool does next.

How far it spread

• 62 consoles served the backdoored build between November 2 and 4, 2026.
• 26 were in the U.S., 17 in Hong Kong and seven in China.
• The first appeared by October 20, twelve days after the image was pushed.
• 1,645 hosts were serving an ARTEX console as of November 4.

The bigger picture

The news came as India's cyber agency, CERT-In, warned about an AI-assisted group it calls Crafty Falcon. It says the group targets banks, insurers and crypto firms using tools like ARTEX, PentAGI, Cairn and CyberStrikeAI. CERT-In says these tools run whole attacks on their own, at machine speed, and the attackers change IP addresses within hours to days. It reports stolen crypto keys and funds.

What to do

• Check where free software comes from before installing it, especially copies of tools that were pulled.
• Limit who can reach payment, cloud and admin accounts, and rotate keys if a tool may have been exposed.
• Do not leave test or admin consoles open to the internet.

What is not known

The material does not say who made the backdoored copy. It also does not say whether Crafty Falcon used it, or who owns the 62 exposed consoles.