Trojanized ARTEX Docker image executed commands before login authentication

A Docker image impersonating an ARTEX continuation inserted a Go function named server.verifyCaptcha into the login path. Its server accepted a crafted pre-authentication login marker and invoked a shell command inside the container running as root.

BadByte compared the binaries and found reachable backdoored consoles. Its November 5 revision records 7,946 pulls by November 3, 62 reachable backdoored panels during the November 2 to 4 scan and 46 still reachable on November 4; a pull is not a confirmed exploited victim.

The supply-chain path began after the original developer withdrew ARTEX's open releases on October 8. A purported continuation changed the container image reference, directing installations toward a different maintainer's Docker image. Inside that image, an added server.verifyCaptcha function was reachable from the login endpoint before password validation and could run shell commands as root within the container. BadByte's revised count is 7,946 pulls before disclosure, not the earlier larger figure. Its survey found 62 reachable infected consoles, with 46 still responding on November 4. Docker Hub removed the two named images on November 5, but removal does not clean already downloaded layers or third-party mirrors. Neither pull counts nor exposed panels prove that the backdoor operator executed commands on every host.

This attack subverts the operator's own offensive console before its login check, rather than exploiting a target that the ARTEX agent was instructed to test. A legitimate-looking image name is not proof of a legitimate binary; the added login-handler branch and digest provide stronger identity markers. Docker Hub's removal of the two reported references prevents those exact pulls but does not revoke already downloaded layers or mirrors. BadByte's pull and internet-exposure counts measure distribution and reachability, not commands executed against all those installations.