Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors are actively exploiting critical pre-auth command injection flaws in Citrix NetScaler (CVE-2026-88771 and CVE-2026-88772) to execute arbitrary commands, deploy web shells (e.g., WHIPSHOT), install a Python reverse/tunneler (SLAPSHOT/main.py), harvest and exfiltrate NetScaler configuration data, create privileged local accounts, and modify system binaries for persistence; multiple IPs and payload filenames were observed across customer environments.