'Friendly' hackers are seemingly fixing the Citrix server hole – and leaving a nasty present behind