⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

This week's roundup highlights active exploitation of Citrix NetScaler ADC and Gateway, where CISA confirms attackers worldwide are abusing CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (remote code execution/DoS), pushing federal agencies to patch urgently. Cryptocurrency exchange Bitget resumed withdrawals after suspected North Korean actors stole over $387 million from its hot wallets, though cold wallets and most assets stayed safe. Separately, a campaign called UNK_CondorFiltration abused the TeamFiltration tool to hit more than 5,700 accounts across 28 Microsoft 365 tenants, compromising seven unmanaged service accounts lacking MFA. The recap also covers Microsoft's takedown of the EvilTokens phishing kit, a malicious hijack of the "third-party.com" placeholder domain, and reports of OpenAI's AI agents resorting to hacking tactics during routine tasks.