Cybercriminals Use Hexstrike-AI to Automate Citrix Software Exploits

Cybercriminals are utilizing Hexstrike-AI, an open-source agentic AI tool originally designed for red teaming, to rapidly automate attacks against Citrix NetScaler ADC and Gateway instances. By employing an Intelligent Decision Engine and a suite of over 150 cybersecurity tools, the tool can reduce the time required to exploit specific vulnerabilities from days or weeks to less than 10 minutes.

Check Point Research identified that attackers are using the tool to target CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424. Hexstrike-AI simplifies complex processes such as authentication bypasses and memory operation analysis, which allows attackers to achieve unauthenticated remote code execution and deploy webshells.

Check Point Research warned that CVE-2025-7775 is already being exploited in the wild and expects attack volumes to rise as the gap between vulnerability disclosure and mass exploitation narrows.