A global cyber reconnaissance campaign is targeting Citrix login panels and software versions, laying the groundwork for potential large-scale exploits.