Weekly Cybersecurity Roundup: Suspected $387M Bitget Hack, Exploited Citrix Flaws and More
Summary
This week's roundup covers active Citrix flaw exploitation, Bitget's response to a suspected $387 million breach, attacks exploiting weak identities and placeholder domains, and law-enforcement action against a phishing service.
Key points
- Citrix said it released patches for NetScaler ADC and Gateway flaws CVE-2026-88771 and CVE-2026-88772; CISA reported global active exploitation and urged federal agencies to patch.
- Bitget resumed Bitcoin withdrawals in phases after a suspected breach involving more than $387 million in unauthorized transfers. The exchange said most assets remained secure and unaffected.
- A placeholder domain, third-party[.]com, was reportedly used to serve a ClickFix lure; researchers said it appeared in about 1,700 repositories.
- Proofpoint reported that the UNK_CondorFiltration campaign targeted more than 5,700 accounts across 28 Microsoft 365 tenants and compromised seven unmanaged service or functional accounts.
- Microsoft and partners dismantled the EvilTokens phishing service, took down more than 50 websites, and arrested two suspected administrators.
- Reports described North Korean-linked campaigns using malicious LNK files and PowerShell, while GitGuardian found 474 leaked GitHub App keys could still authenticate.
Article Details
- Event Type
- Weekly cybersecurity threat roundup covering active exploitation, data theft, phishing and malware campaigns, cybercrime disruption, and security incidents.
- Impact
- Bitget reported unauthorized transfers from a limited number of hot wallets and losses exceeding $387 million; it said cold wallets and most platform assets were unaffected, and resumed Bitcoin withdrawals in phases. Citrix NetScaler flaws were reported under active global exploitation, while CISA said ransomware gangs were exploiting a JetBrains TeamCity authentication bypass. Other reported activity included malicious placeholder-domain lures, attacks on Microsoft 365 accounts, malware campaigns targeting Ukraine-focused individuals and organizations, and exposed GitHub App keys that could enable access to private repositories or organizational infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | third-party[.]com | Reported malicious lure infrastructure serving a ClickFix lure to Windows browsers. |
| DOMAIN | your-domain[.]com | Reported placeholder domain serving scams and scareware to macOS visitors. |
| DOMAIN | yoursite[.]com | Reported placeholder domain serving scams and scareware to macOS visitors. |
CVE
CVE-2026-42608an unpatched Grav CMS flaw that’s now assessed to be an unauthenticated path traversal vulnerability (CVE-2026-42608).CVE-2026-63077The flaw, CVE-2026-63077, is a critical authentication bypass vulnerability that lets attackers with HTTP(S) access execute arbitrary operating system commands.CVE-2026-88771Citrix NetScaler ADC and Gateway flaws CVE-2026-88771 and CVE-2026-88772 are being actively exploited worldwide.CVE-2026-88772Citrix NetScaler ADC and Gateway flaws CVE-2026-88771 and CVE-2026-88772 are being actively exploited worldwide.
People
Ahmed Hossam Eldin ElbadawySentenced after admitting to being a member of Scattered Spider.Dirk-jan MollemaSecurity researcher whose prior research on rogue registered external authentication method providers was cited in connection with TrustSink.Felix UtomiSuspected website admin of the EvilTokens phishing service arrested in the law-enforcement action.Karen Serobovich VardanyanSentenced for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies in the United States.Waidi Segun AdamsSuspected website admin of the EvilTokens phishing service arrested in the law-enforcement action.
Threat Actors
ClopRansomware gang whose data-leak site was moved after its previous server was compromised and defaced; Clop denied a relationship with ShinyHunters.KimsukyReportedly conducted Git-based C2 attacks using malicious LNK files in ZIP archives.KonniNorth Korean threat group reported using malicious LNK files in spear-phishing attacks targeting Ukraine-focused individuals and organizations.ShinyHuntersReportedly compromised and defaced Clop’s previous data-leak-site server through a Grav CMS flaw.Storm-2992Microsoft attributes development and support of the EvilTokens phishing platform to this tracked group.
Malware
ArechClient2“SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands,” Fortinet said.PamStealer#CitrixRyuk#CitrixSectopRATSectopRAT Hides Inside Legitimate Application — A new campaign has been observed delivering SectopRAT by concealing it within a legitimate program developed by an Italian digital-audio company.VelvetCakeattacks targeting Ukraine-focused individuals and organizations to deliver a malware called VelvetCake as part of a campaign codenamed Operation Conflict Compass.x47.cNew x47.c Botnet Drains AI API Credits — A previously undocumented Windows botnet dubbed x47.c has been advertised as capable of supporting 18 DDoS attack methods, browser credential theft, SOCKS5 proxies, and an AI
Vendors
BitgetThis week’s roundup highlights active exploitation of Citrix NetScaler flaws, a major Bitget breach, and multiple campaigns abusing weak identities, phishing kits, and old vulnerabilities.CitrixThis week’s roundup highlights active exploitation of Citrix NetScaler flaws, a major Bitget breach, and multiple campaigns abusing weak identities, phishing kits, and old vulnerabilities.Fortinet“SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands,” Fortinet said.GoogleEvery doc, test, and skill that hard-coded it now points readers at attacker infrastructure.” As of writing, the domain has been marked as malicious and unsafe on both VirusTotal and Google’s Safe Browsing list.JetBrainsCISA Flags TeamCity Flaw as Exploited in Ransomware Attacks — CISA confirmed that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July.MicrosoftTeamFiltration abused weak Microsoft 365 service accounts, exposing forgotten identities without MFA.OpenAIOpenAI Linked to More Website Hacks — AI research lab Transluce found three instances between May and June 2026 in which OpenAI’s agents resorted to hacking when traditional methods failed.
Products
GitHubIt also shows how forgotten placeholder domains, exposed service accounts, and leaked GitHub App keys continue to create real attack paths for threat actors.Grav CMSTor address after its previous server was compromised and defaced by ShinyHunters through an unpatched Grav CMS flaw that’s now assessed to be an unauthenticated path traversal vulnerability (CVE-2026-42608).Microsoft 365 Apps for EnterpriseTeamFiltration abused weak Microsoft 365 service accounts, exposing forgotten identities without MFA.NetScaler ADCCitrix NetScaler ADC and Gateway flaws CVE-2026-88771 and CVE-2026-88772 are being actively exploited worldwide.Private AI ComputeDeepMind Gives Private AI Compute a Secure, Server-Side Memory — Google has announced plans to bring a private, server-side memory to its Private AI Compute platform, giving AI systems long-term continuity acrossTeamCityCISA Flags TeamCity Flaw as Exploited in Ransomware Attacks — CISA confirmed that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July.
Tools
EvilTokens#CitrixGPT4Allspotlighting a trend where the threat actor has used local large language models (LLMs) using Ollama, GPT4All, and Msty to prepare attacks and create decoys.Mstya trend where the threat actor has used local large language models (LLMs) using Ollama, GPT4All, and Msty to prepare attacks and create decoys.OllamaAI models, spotlighting a trend where the threat actor has used local large language models (LLMs) using Ollama, GPT4All, and Msty to prepare attacks and create decoys.TeamFiltration#CitrixTrustSinkRogue External MFA Provider to Steal Passwords — Varonis has demonstrated a new attack technique called TrustSink which turns a rogue external MFA provider into a “persistent credential trap” within a legitimate
Countries
Industries
CryptocurrencyBitget Resumes Withdrawals After Hack — Cryptocurrency exchange Bitget resumed Bitcoin withdrawals in phases after suspected North Korean hackers breached its systems last week and stole over $387 million.RetailThe activity has primarily focused on Chilean retail and financial institutions.