Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

WHIPSHOT is disguised as a Debian package and hides Base64-encoded command-and-control payloads in native HTTP headers. It ...