Citrix NetScaler

Security reports detail post-exploitation activity targeting Citrix NetScaler appliances, where attackers deploy payloads that create superuser accounts and disguise web shells as CSS-like URLs to evade detection. The technique raises concerns for organisations running NetScaler gateways, as compromised devices may grant persistent privileged access. Administrators are advised to review devices for unexpected accounts and unusual URL patterns.