CERT-In says an AI-assisted threat actor it tracks as Crafty Falcon is targeting organizations in India’s Banking, Financial Services, and Insurance sector, while also hitting cryptocurrency exchanges and digital asset service providers. The activity is described as active and ongoing, and it uses publicly available AI-driven offensive security tools including ARTEX, PentAGI, Cairn, and CyberStrikeAI.
CERT-In warns that the same campaign has used internet-facing applications, exposed APIs, privileged endpoints, cloud infrastructure, and publicly accessible non-production environments to steal credentials, tokens, and network paths. A separate ARTEX issue also surfaced in which a Docker image pulled by a GitHub copy of ARTEX was altered to hand out root access during an unauthenticated login request.
What CERT-In says about the AI-assisted campaign
The agency says the tools can carry out complete attack chains on their own at machine speed. It also says they can generate and refine large numbers of tailored attack scripts quickly, adapt payloads to target responses, and rotate supporting infrastructure IP addresses within hours to days.
CERT-In says the attacks on financial organizations have stolen keys and funds. It also says threat actors have used stolen long-lived static API tokens, forged commits in source code repositories, plaintext credentials in configuration files, source code, or databases, and access to applications and remote services that lack multi-factor authentication.
The agency says this method defeats application-level controls tied to loan creation, KYC, sanction checks, beneficiary verification, balance sufficiency, and per-transaction limits. Rapid fraudulent transfers are then directed to attacker-controlled mule accounts across multiple banks, while logs are deleted and endpoint security tools are tampered with to make detection and incident response harder.
Cloud and API abuse in the same campaign
CERT-In says attackers are also targeting cloud infrastructure to run commands and deploy malicious payloads. It says publicly accessible non-production environments are being used to obtain shared credentials, tokens, or network paths, which are then used to pivot into production systems.
Other post-exploitation actions in the campaign include reverse-engineering application codebases to build tailored exploits and initiating unauthorized API calls with modified application packages. The agency says those calls undermine controls that assumed only the legitimate client application would call the APIs.
The same set of actions also includes micro-value test transactions, such as Rs. 1, to confirm unauthorized fund flows before larger transfers. CERT-In says merchant settlement APIs of payment aggregators are being abused to move funds, and newly disclosed vulnerabilities are being exploited through file-upload and deserialization chains that lead to web shells in PHP and Node.js applications. It also says attackers are creating many custom scripts on the fly and improving them quickly, which fits AI-assisted development.
CERT-In’s AI security guidance
CERT-In has also published Artificial Intelligence Security Auditing Guidelines. The framework lays out requirements for the governance, security, privacy, fairness, transparency, resilience, and auditability of AI systems.
The guidelines call for testing an AI agent’s documented identities, authorized objectives, approved tool use, permission boundaries, and adherence to the principle of least privilege. They also require human approval for consequential actions. For high-risk AI systems, the framework calls for emergency interruption, credential revocation, and controls that prevent automatic restarts.
The agency says effective assurance needs organizational accountability, technical testing, data and model governance, continuous monitoring, human oversight, incident response, and third-party assurance. It adds that the framework provides auditable requirements matched to the nature, scale, autonomy, and potential impact of each AI system.
How the ARTEX copy was turned into a backdoor
The abuse of ARTEX in real intrusions led its developer to remove the repository from GitHub. Copies then appeared on GitHub, including github[.]com/trhhubsd/ARTEXX, github[.]com/mhtsec/ARTEX, and github[.]com/RuoJi6/ARTEX.
The first two repositories are no longer available for download. Independent researcher Badbyte says the trhhubsd/ARTEX repository was starred 2,449 times and forked over 600 times. The GitHub copy changed one line in docker-compose.yml to pull the tomicdd/artex image from Docker Hub, and that image includes a hidden routine that gives a root shell during an unauthenticated request to the login endpoint.
Badbyte says the hidden verifyCaptcha() function sends the rest of the request through sh -c as root when the CAPTCHA field starts with a secret marker, and returns the output before any credential check. The researcher called that an unauthenticated root shell on every install.
The scale of the exposed ARTEX consoles
Badbyte says a compromised ARTEX instance can hold unpatched findings, live credentials, captured sessions, and network position. The same backdoor can also quietly change what the agents do on the next run.
As many as 62 ARTEX consoles on the internet were found serving the backdoored build between November 2 and 4, 2026. The first instance appeared by October 20, 2026, which was twelve days after the Docker image was pushed. Of those consoles, 26 were in the U.S., 17 in Hong Kong, and seven in China.
By November 4, 2026, a total of 1,645 hosts were found serving the ARTEX console. Docker Hub namespaces publishing images named artex also included congdonglinux/artex, which is described as backdoored and identical to tomicdd/artex, along with mianhuatang11/artex, autumn26/artex, andy1099zz/artex, dgddw/artex, trhhubsd/ARTEX, and ylh440104/artex.
Badbyte said the backdoor’s author needed nothing more than a user running an unvetted attack tool as root on an open port. The researcher also said ARTEX has been used maliciously in the wild and will keep being used that way, while many legitimate users installed it simply to see what it did.
Licensed under CC BY-ND 4.0 International