Threat Actors Conduct Widespread Scanning for Exposed Citrix NetScaler Login Pages

Gbhackers •Divya • February 4, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Reconnaissance Campaign Targets Citrix NetScaler Infrastructure Between January 28 and February 2, 2026, a large-scale reconnaissance campaign was detected targeting Citrix ADC Gateway and NetScaler Gateway infrastructure. The operation involved over 111,834 sessions generated from more than 63,000 unique IP addresses, utilizing residential proxy rotation for login panel discovery and AWS-hosted version disclosure scanning. 3 sources 25

Extracted Entities

Vulnerabilities (1)

Citrix NetScaler