ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More

This week's ThreatsDay Bulletin covers a broad range of active cybersecurity threats and newly disclosed attack techniques.

• •The Gentlemen RaaS group exploits CVE-2024-55591 in FortiGate, maintaining a database of ~14,700 compromised devices and 969 brute-forced VPN credentials
• •BMC FootPrints ITSM has four chained CVEs enabling pre-auth RCE via authentication bypass and Java deserialization
• •CursorJack abuses Cursor's MCP deep link protocol handler to execute arbitrary local commands or install malicious remote MCP servers
• •Citrix NetScaler flaws CVE-2025-5777 and CVE-2023-4966 saw 500+ exploit attempts against honeypots on a single day
• •Microsoft Teams phishing campaigns impersonate IT departments to gain remote access via Quick Assist