Novemberโs Top Cyber Attacks: XWorm, JSGuLdr, Mobile Threats, and Multi-Stage Campaigns Surge Worldwide
DUBAI, DUBAI, UNITED ARAB EMIRATES, December 1, 2025 /EINPresswire.com/ -- Cyberattacks continued to intensify in November as attackers relied on multi-stage loaders, in-memory execution, and cross-platform payloads. ANY.RUN reports a noticeable rise in loader-driven intrusions, encrypted payload containers, and campaigns targeting Windows, Linux, and Android environments.
The November 2025 Threat Analysis shows how modern attacks blend JavaScript, PowerShell, Linux services, and mobile components to move quietly through enterprise networks, often without leaving traditional executables behind.
๐๐๐-๐๐๐ฌ๐๐ ๐๐ง-๐๐๐ฆ๐จ๐ซ๐ฒ ๐๐จ๐๐๐ข๐ง๐ : ๐๐๐จ๐ซ๐ฆ ๐๐ญ๐๐๐ฅ๐๐ซ ๐๐๐ญ๐ฎ๐ซ๐ง๐ฌ
A new XWorm wave used phishing pages to deliver an obfuscated JavaScript dropper that hid AES-encrypted payloads inside PNG files. By loading the .NET assembly directly in memory, the malware avoided on-disk artifacts and enabled credential theft and remote access attempts inside corporate environments.
๐๐๐๐ฎ๐๐๐ซ: ๐๐ฎ๐ฅ๐ญ๐ข-๐๐ญ๐๐ ๐ ๐๐จ๐๐๐๐ซ ๐๐๐ฅ๐ข๐ฏ๐๐ซ๐ข๐ง๐ ๐๐ก๐๐ง๐ญ๐จ๐ฆ๐๐ญ๐๐๐ฅ๐๐ซ
ANY.RUN analysts identified JSGuLdr, a multi-stage loader that begins with obfuscated JScript and uses COM to launch PowerShell under explorer.exe, making the activity appear routine. PowerShell then downloads and decrypts a payload from Google Drive and executes it, leading to PhantomStealer being injected into msiexec.exe. This approach enables quiet data theft inside corporate environments with almost no on-disk traces.
For deeper visibility into these threats, including live analyses, key indicators, and detection guidance, explore the ANY.RUN blog.
๐๐ญ๐ก๐๐ซ ๐๐ก๐ซ๐๐๐ญ๐ฌ ๐๐ฆ๐ฉ๐๐๐ญ๐ข๐ง๐ ๐๐จ๐ฆ๐ฉ๐๐ง๐ข๐๐ฌ
ยท ๐ฅ๐ผ๐ป๐ถ๐ป๐ด๐๐ผ๐ฎ๐ฑ๐ฒ๐ฟ, ๐๐ผ๐น๐ฑ๐ถ๐ป๐ด๐๐ฎ๐ป๐ฑ๐, ๐ฆ๐ป๐ผ๐๐น๐ถ๐ด๐ต๐: Cross-platform loader and RAT chain enabling access to both corporate endpoints and Linux servers.
ยท ๐ฃ๐๐๐๐ต๐ฎ๐บ๐ฝ๐ถ๐ผ๐ป๐, ๐๐ณ๐ถ๐บ๐ฒ๐ฟ, ๐๐ง๐ ๐ข๐: Browser hijacking, Tor-based credential theft, and Android trojans targeting employee devices and corporate accounts.
ยท ๐ ๐ผ๐ป๐ธ๐ฒ๐, ๐ฃ๐ต๐ผ๐ฒ๐ป๐ถ๐ , ๐ก๐ผ๐ป๐๐๐ฐ๐น๐ถ๐ฑ: Linux ransomware, targeted Windows backdoors, and hybrid RATโransomware used for deeper intrusion into enterprise environments.
ยท ๐๐๐ฅ๐ค๐ฒ๐ซ๐ข๐, ๐๐๐ฎ๐ณ๐ฎ๐๐ง, ๐๐จ๐ซ๐ฏ๐๐ฉ๐จ๐ญ๐๐ฅ: Credential theft, adaptable backdoors, and WhatsApp-based malware spreading through trusted communication channels.
๐๐๐จ๐ฎ๐ญ ๐๐๐.๐๐๐
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions used by 15,000 organizations and over 500,000 analysts worldwide. The service combines a live Interactive Sandbox, TI Lookup for instant IOC enrichment, and continuously updated Threat Intelligence Feeds to help security teams investigate faster, improve detection logic, and respond to emerging threats with confidence.
The ANY.RUN team
ANYRUN FZCO
+1 657-366-5050
email us here
Visit us on social media:
LinkedIn
YouTube
X
1 https://any.run/?utm_source=ein&utm_medium=press_release&utm_campaign=november_attacks&utm_content=landing&utm_term=011225
2 https://any.run/cybersecurity-blog/major-cyber-attacks-november-2025/?utm_source=ein&utm_medium=press_release&utm_campaign=november_attacks&utm_content=blog&utm_term=011225
