[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f32hfix452jcyo":3},{"_id":4,"slug":5,"title":6,"subtitle":7,"kind":8,"cards":9,"tags":59,"categories":61,"source":62,"lang":65,"author":66,"audioState":69,"stats":70,"publishedAt":73,"renderer":74},"6aba8199ca21c797c7e99ef4","weekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588","⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats","A domain used as harmless placeholder text showed up in roughly 1,700 repositories.","news",[10,14,19,24,29,34,39,44,49,54],{"headline":11,"body":12,"imageUrl":13,"sourceImageUrl":13},"⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script…","A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh4-eWVCAN2nvZGZrKlwm-wminZE56MzJ_bVRK6CJfdBw9TXU4yQy6t9T0hDi0hSOskE9Xs6M-KCVEbVvBuL2DLDkew97W2iobOPZa9zqEBeGPWBnW8cftdD1FwzBLz7CIGVhJb1FwnS-35B62Jqc331zNQ67hZP-V2jKBT7yUxUV4rn8jMr27QCommYp-j\u002Fs1700-nu-rw-lo-l85-e365\u002Fc-recap.jpg",{"headline":15,"body":16,"imageUrl":17,"images":18},"Elsewhere, weak service accounts, old bugs, exposed systems","Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore. Here’s the full recap of what mattered this week.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F1.webp",{"local":17},{"headline":20,"body":21,"imageUrl":22,"images":23},"Citrix Warns of Actively Exploited NetScaler ADC and","Citrix Warns of Actively Exploited NetScaler ADC and Gateway Flaws — Citrix released patches to address multiple vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, that have come under active exploitation. CVE-2026-88771 is an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands, while successful exploitation of CVE-2026-88772 could allow for remote code execution or denial-of-service. CISA said \"threat actors are actively exploiting these vulnerabilities globally,\" urging federal agencies to apply patches by Wednesday. Five Security Leaders. One Question: What Changes When Attackers Have AI?","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F2.webp",{"local":22},{"headline":25,"body":26,"imageUrl":27,"images":28},"Mikko Hyppönen, Volkan Erturk, and security leaders from","Mikko Hyppönen, Volkan Erturk, and security leaders from Chanel, the NFL, and Atlassian bring five distinct perspectives to The Validation Summit ’26. Hear what changed, what needs to change, and how leading teams are responding.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F3.webp",{"local":27},{"headline":30,"body":31,"imageUrl":32,"images":33},"Bitget Resumes Withdrawals After Hack — Cryptocurrency exchange","Bitget Resumes Withdrawals After Hack — Cryptocurrency exchange Bitget resumed Bitcoin withdrawals in phases after suspected North Korean hackers breached its systems last week and stole over $387 million. \"At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets,\" Bitget said. \"Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected.\" According to a real-time fund tracing dashboard published by Coindesk, Circle and Tether have frozen stablecoins worth $339,100 linked to the hack.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F4.webp",{"local":32},{"headline":35,"body":36,"imageUrl":37,"images":38},"PamStealer Adds Live C2 Payload Decryption — A","PamStealer Adds Live C2 Payload Decryption — A new version of PamStealer has been found to incorporate a new anti-analysis trick that ensures the main payload can only be recovered using a server-side decryption chain. The latest artifacts continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. \"Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped,\" Jamf said. \"Without the server's cooperation, the payload cannot be recovered statically.\"","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F5.webp",{"local":37},{"headline":40,"body":41,"imageUrl":42,"images":43},"Placeholder Domain Found References in ~1.7K Repos","Placeholder Domain Found References in ~1.7K Repos — The \"third-party[.]com\" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. \"third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,\" Manifold Security said. \"Unlike 'example[.]com,' third-party[.]com is not IANA-reserved. Anyone could register it, and someone did. Every doc, test, and skill that hard-coded it now points readers at attacker infrastructure.\" As of writing, the domain has been marked as malicious and unsafe on both VirusTotal and Google's Safe Browsing list.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F6.webp",{"local":42},{"headline":45,"body":46,"imageUrl":47,"images":48},"Manifold also identified 13 more placeholder domains that","Manifold also identified 13 more placeholder domains that are not IANA-reserved, with two of them – yoursite[.]com and your-domain[.]com – serving scams and scareware to macOS visitors and an ordinary parking page to other users.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F7.webp",{"local":47},{"headline":50,"body":51,"imageUrl":52,"images":53},"UNK_CondorFiltration Abuses TeamFiltration in New Campaign — An","UNK_CondorFiltration Abuses TeamFiltration in New Campaign — An active TeamFiltration campaign codenamed UNK_CondorFiltration has targeted over 5,700 accounts across 28 Microsoft 365 tenants. The activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. \"The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA,\" Proofpoint said. The activity took place over three waves from late July to August 2026.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F8.webp",{"local":52},{"headline":55,"body":56,"imageUrl":57,"images":58},"EvilTokens Taken Down in Law Enforcement Action","EvilTokens Taken Down in Law Enforcement Action — A coalition of law enforcement and private-sector tech companies led by Microsoft dismantled the EvilTokens phishing service, arresting two suspected website admins, Felix Utomi and Waidi Segun Adams, taking down more than 50 websites, and notifying victims of compromised email accounts. Per Coinbase, the EvilTokens operators were said to be working on expanding the kit to target Gmail and Okta accounts at the time of the takedown. Microsoft attributes the development and support of the platform to Storm-2992. EvilTokens is the latest example of professionalization of cybercrime, allowing bad actors to mount phishing campaigns with little effort and at scale.","\u002Fapi\u002Fmedia\u002Fposts\u002Fweekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-o-7d4f9588\u002F9.webp",{"local":57},[60],"security",[],{"name":63,"url":64},"The Hacker News","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fweekly-recap-387m-crypto-hack-citrix.html","en",{"handle":67,"displayName":68},"spots","Spots","queued",{"views":71,"likes":72,"saves":72,"shares":72,"completions":72,"opens":72,"skips":72,"depthSum":72},3,0,"2026-09-28T15:02:49.052Z","local"]