Nov 17, 2025

The cyber underground didn’t slow down this week, Digital Defenders.

From ERP backdoors to weaponized lost phone alerts, dormant package swarms, billion-dollar phishing engines, and global scam rings under federal fire… cyber threats are evolving at record speed.

Here’s what you need to know:

Zero-Day Download

SAP Emergency Patch Fixes Critical System-Takeover Flaw

SAP’s latest security update includes an emergency fix for a Solution Manager vulnerability that lets unauthenticated attackers inject and execute arbitrary code.

The Solution Manager flaw (CVE-2025-42887) stems from an unsanitized remote-enabled function module, exposing SAP’s central management hub to takeover.

SAP Emergency Patch Fixes Critical System-Takeover Flaw

Source: Kittyfly/Shutterstock

SAP has released patches for the vulnerabilities.

Apply the latest SAP patches, lock down SolMan access, monitor for anomalies, and regularly audit accounts and configurations.

Fake Find My Messages Target Lost iPhones in New Scam

Switzerland’s NCSC warns that scammers are stealing Apple IDs by targeting users immediately after they lose their iPhones.

After a device goes missing, attackers send convincing fake Find My messages with real device details to trick victims into entering their Apple IDs on spoofed sites.

Compromised Apple IDs let threat actors bypass Activation Lock and access sensitive data.

Instruct employees to ignore all “device found” messages and initiate Lost Mode only through official Apple sites — never through links received by email or SMS.

How 43,000 NPM Spam Packages Evaded Detection for Years

A newly uncovered campaign injected over 43,000 dormant packages into npm, marking one of the largest supply-chain spam incidents to date.

Researchers found the IndonesianFoods worm used randomized names, legitimate-looking templates, and dormant payloads to blend into npm. This is an ongoing issue.

Audit your environment for packages from the affected npm accounts and deploy SCA tools that detect dormant files and suspicious dependency structures.

Share this newsletter!

Pulse Check

If your phone vanished right now… what’s the real risk?

🛡 Locked Down – Strong security; little to worry about

🔍 Some Exposure – A few gaps an attacker could exploit

😬 High Risk – They are seeing everything

Yesterday's Pulse Check Results

Update Instinct Test: Would you fall for a fake app update?

Security Tools You Can Use

Become the threat actors’ worst nightmare — master red teaming.
Spot the weak points now, not after someone breaks in.
Stop guessing in the cloud — learn Google’s tools now while it’s 87% off.

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

U.S. Forms Strike Force to Disrupt Global Crypto Scam Networks

A new federal Strike Force has been launched to dismantle the sprawling “pig-butchering” scam operations driving billions in global cryptocurrency fraud.

The initiative unites the DOJ, Treasury, FBI, Secret Service, and other agencies in a coordinated campaign targeting transnational crime groups running industrial-scale fraud compounds across Southeast Asia.

U.S. Forms Strike Force to Disrupt Global Crypto Scam Networks

Source: Katie Moum/Unsplash

The Strike Force has ongoing operations against the target groups.

Review your organization’s crypto-related touchpoints and ensure partners undergo enhanced due-diligence screening against OFAC, FinCEN, and DOJ enforcement alerts.

Google Sues China-Based Phishing Network Behind $1B Global Scam

Google has filed a major lawsuit against a China-based group behind Lighthouse, a phishing-as-a-service platform tied to over $1 billion in global fraud.

The platform gives scammers subscription access to thousands of brand-spoofing templates, enabling large-scale email, SMS, and website phishing attacks.

Google’s lawsuit seeks to dismantle the network under US racketeering and computer fraud laws.

Enforce rapid enterprise passkey adoption and disable password-only authentication wherever possible to neutralize credential-theft phishing.

Security Tip of the Day

How Can You Protect Users From Scams?

Scams are evolving faster than ever, blending social engineering, device impersonation, and AI-assisted tactics to trick even vigilant users.

Source: Giphy

Simple steps to shield your users from today’s scams:

Enable strong authentication like MFA or passkeys to block credential-theft attempts.
Verify URLs and limit lock-screen information to reduce data exposure.
Use modern message filtering and report suspicious activity quickly.

Together, these simple habits create a stronger, more resilient defense that helps users avoid scams and keeps your organization safer.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.