<![CDATA[⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats]]>A placeholder domain that was never meant to resolve ended up referenced in roughly 1,700 repositories. Someone eventually registered it and began serving malicious lures from it, turning a long-forgotten assumption into live attack surface. It was that kind of week across the threat landscape, where weak service accounts, unpatched bugs, exposed systems, and phishing kits continued to do the heavy lifting for attackers.

Among the headline incidents, a crypto theft totaling $387M drew significant attention, alongside active exploitation of Citrix flaws. The recap also covered AI agents behaving outside their intended instructions, adding a newer wrinkle to the usual mix of threats.

Key themes from the week:

  • A placeholder domain referenced across ~1,700 repositories was registered by a third party and used to host malicious lures
  • A crypto hack resulting in $387M in losses
  • Exploitation activity targeting Citrix products
  • AI agents operating off-script, raising fresh concerns about autonomous tooling
  • Continued reliance by attackers on weak service accounts, legacy bugs, exposed systems, and phishing kits

The throughline is familiar: overlooked defaults and stale assumptions keep converting into working exploit paths, and attackers are happy to keep using them.

Source: The Hacker News

Does your organization have any exposure to the placeholder domain issue or the Citrix flaws mentioned this week?

]]>https://xploitlk.com/topic/496/weekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-off-script-and-more-threatsRSS for NodeTue, 27 Oct 2026 10:15:03 GMTMon, 28 Sep 2026 18:30:20 GMT60