NetNut seized; Citrix Bleed 2 exploited; ToddyCat hijacks Gmail via OAuth

This briefing reports multiple high-priority threats: Google/FBI actions degraded the NetNut residential proxy network abused for fraud and account takeover; Citrix Bleed 2 (CVE-2025-5777) is being actively exploited by Anubis ransomware affiliates; ToddyCat’s Umbrij malware is abusing Google OAuth to access corporate Gmail; and ConsentFix/ClickFix campaigns are stealing Microsoft 365 tokens by abusing OAuth consent flows — recommended actions include urgent Citrix patching, auditing OAuth consents, blocking NetNut-related infrastructure, and tightening conditional access policies.