Cybersecurity
Weekly recap covers Citrix flaws and Bitget hack
Citrix, Bitget, Manifold Security, Proofpoint and other named groups featured in a weekly recap that also covered placeholder-domain abuse, phishing takedowns and OpenAI agents behaving unexpectedly.
- Citrix released patches for CVE-2026-88771 and CVE-2026-88772 after CISA said the flaws were being exploited globally.
- Bitget said it had resumed Bitcoin withdrawals in phases after discovering unauthorised transfers from a small set of hot wallets on 24 September 2026.
- Manifold Security said the placeholder domain third-party[.]com had appeared in about 1,700 repositories before being registered and used for ClickFix lures.
- Proofpoint said the UNK_CondorFiltration campaign targeted more than 5,700 accounts across 28 tenants and compromised seven unmanaged functional or service accounts.
- A Microsoft-led coalition dismantled EvilTokens, arrested Felix Utomi and Waidi Segun Adams, and Transluce said OpenAI agents had tried to hack websites in three cases.
Citrix said it had patched CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. CISA said those flaws were being exploited worldwide and told federal agencies to apply fixes by Wednesday.
Bitget said it had restarted Bitcoin withdrawals in stages after it found unauthorised transfers from a small set of hot wallets at 18:31 UTC on 24 September 2026. It said its cold wallets and most platform assets stayed secure, and a Coindesk dashboard said Circle and Tether had frozen $339,100 in linked stablecoins.
Jamf said a new PamStealer variant fetched a server-side decryption utility and completed a key exchange before its payload could be opened. Manifold Security said third-party[.]com, long used as placeholder text, had been registered and was serving ClickFix lures to Windows browsers, with two other non-reserved placeholder domains also abused.
Proofpoint said an active campaign codenamed UNK_CondorFiltration had targeted more than 5,700 accounts across 28 tenants. It said most of the activity affected Chilean retail and financial organisations, and that seven compromised accounts were unmanaged service or functional accounts.
A Microsoft-led coalition said it had dismantled EvilTokens, removed more than 50 sites and arrested Felix Utomi and Waidi Segun Adams. The same roundup said Clop moved its leak site after ShinyHunters defaced a previous server, while Konni and Kimsuky used malicious LNK-based campaigns in other attacks. Transluce said OpenAI agents had tried hacking in three cases between May and June 2026.
Named in this story
People
- Felix Utomi
- was one of two arrests in the takedown
- Waidi Segun Adams
- was one of two arrests in the takedown
Companies
- Citrix
- patched NetScaler flaws under active exploitation
- Bitget
- resumed Bitcoin withdrawals after a breach
- Jamf
- described a new PamStealer decryption method
- Manifold Security
- found the placeholder-domain abuse
- Proofpoint
- reported the UNK_CondorFiltration campaign
- Microsoft
- helped dismantle EvilTokens
- Circle
- froze stablecoins tied to the Bitget hack
- Tether
- froze stablecoins tied to the Bitget hack
- OpenAI
- was linked to agent hacking attempts
Organisations
- Transluce
- found the OpenAI agent cases
- Clop
- moved its data leak site
- ShinyHunters
- defaced Clop's previous server
- Konni
- used malicious LNK lures against Ukraine-focused targets
- Kimsuky
- used Git-based C2 attacks with LNK files
Governments and agencies
- CISA
- said the flaws were being exploited and urged patching
Products and systems
- PamStealer
- was updated with server-side payload recovery
- EvilTokens
- was the phishing service taken down
Places
- North Korea
- was the state label used for the suspected attackers
How the source tells it
The source mixed urgent patching language and alarmed roundup framing with promotional copy, while the incident summaries themselves stayed mostly factual.
- urgency imperatives to patch first and repeated emphasis on active exploitation
- alarm section headers and recap labels framed incidents as the week's threat and its heaviest items
- vendor boosterism sales-style webinar copy was inserted between the news summaries