{"id":17015,"date":"2025-11-26T09:52:56","date_gmt":"2025-11-26T09:52:56","guid":{"rendered":"\/cybersecurity-blog\/?p=17015"},"modified":"2025-11-26T10:32:49","modified_gmt":"2025-11-26T10:32:49","slug":"major-cyber-attacks-november-2025","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/major-cyber-attacks-november-2025\/","title":{"rendered":"Major Cyber Attacks in November 2025: XWorm,\u00a0JSGuLdr\u00a0Loader, Phoenix Backdoor, Mobile Threats, and More\u00a0"},"content":{"rendered":"\n

Stealers, loaders, and targeted campaigns dominated November\u2019s activity. ANY.RUN<\/a> analysts examined cases ranging from PNG-based in-memory loading used to deploy XWorm to JSGuLdr, a three-stage JavaScript-to-PowerShell loader pushing PhantomStealer. <\/p>\n\n\n\n

Alongside these public cases, three Threat Intelligence Reports detailed new activity across Windows, Linux, and Android, including loader-enabled hijackers, Tor-based cryptotrojan communication, Linux ransomware in Go, MaaS stealers, and a WhatsApp-propagating campaign with geofencing controls. <\/p>\n\n\n\n

Each case was\u00a0analyzed\u00a0inside\u00a0ANY.RUN\u2019s Interactive Sandbox<\/a>, revealing execution flows, persistence mechanisms, and\u00a0behavioral\u00a0indicators that help teams tune detections and trace related activity.\u00a0<\/p>\n\n\n\n

Let\u2019s break down how these attacks unfolded, where they hit, and what security teams can take away to strengthen their defenses before the next wave arrives. <\/p>\n\n\n\n

1. XWorm: PNG Files Used as Containers for an In-Memory Loader <\/h2>\n\n\n\n

Post on X<\/a> <\/p>\n\n\n\n

ANY.RUN analysts observed a new wave of XWorm infections in November, delivered through phishing pages and emails that distribute a JavaScript dropper named PurchaseOrder_25005092.js<\/strong>. While it appears benign at first glance, the script unpacks a full multi-stage chain designed to bypass quick checks, hide payloads inside PNG files, and execute a .NET assembly directly in memory. <\/p>\n\n\n\n

How the attack begins <\/h3>\n\n\n\n

The campaign begins with a phishing lure (T1566.001)<\/strong> delivering a heavily obfuscated JavaScript installer (T1027)<\/strong>. Once executed, the script checks whether the required components exist on the system and writes the missing files to C:\\Users\\PUBLIC<\/strong> using Base64-encoded and AES-encrypted data (T1027.013)<\/strong>. The staged components are later used during the PowerShell-driven decryption and in-memory execution stages. <\/p>\n\n\n\n

The three staged files are: <\/p>\n\n\n\n