Hackers are exploiting a flaw in Citrix software despite fix