Landfall Android Spyware Hits Samsung Phones Using Zero-Day Exploits

Summary Points

1. A new Android spyware named Landfall exploited a zero-day vulnerability (CVE-2025-21042) in Samsung’s image processing library to target Galaxy devices via specially crafted DNG images sent through WhatsApp, possibly with a zero-click attack method.
2. Landfall infects Samsung Galaxy S22, S23, S24, Z Fold4, and Z Flip4 models, granting attackers access to microphone, location, photos, contacts, call logs, and enabling data exfiltration for espionage purposes.
3. Samsung patched CVE-2025-21042 in April 2025, but Palo Alto Networks reports attacks have been ongoing since at least July 2024, with evidence suggesting prior exploitation of the vulnerability during the infection campaigns.
4. The malware’s development is currently unattributed, with possible links to the UAE’s Stealth Falcon or surveillance firms like NSO, Variston, and Cytrox; targeted regions include Middle Eastern and North African countries.

Key Challenge

Palo Alto Networks recently uncovered a sophisticated Android spyware called Landfall, which was secretly deployed on Samsung Galaxy phones, including the S22, S23, and Fold4 models, through a zero-day vulnerability in the device’s image processing library (CVE-2025-21042). Attackers exploited this flaw by sending specially crafted DNG images via WhatsApp, potentially executing remote code without user interaction, making it a zero-click attack. Once infected, these devices allowed malicious actors to conduct extensive spying activities—accessing microphones, trackers, photos, contacts, and call logs—revealing a targeted effort primarily aimed at individuals in the Middle East and North Africa. Although Samsung patched the vulnerability in April, the attacks had been ongoing since at least July 2024, indicating the spyware’s deployment predates the fix, and Palo Alto’s investigation has so far not linked Landfall directly to a known spyware vendor or a specific nation-state, though some connections to Middle Eastern groups have been suggested. The researchers report that the threat actor behind Landfall remains unidentified, but similarities in the exploit techniques with other recent vulnerabilities suggest a complex and evolving landscape of covert surveillance threats exploiting image processing flaws in mobile devices.

Critical Concerns

The emergence of the “Landfall Android Spyware Targeted Samsung Phones via Zero-Day” exploit underscores a serious threat that could easily impact your business, as malicious actors leverage undiscovered vulnerabilities to covertly infiltrate Android devices—especially high-profile manufacturers like Samsung—potentially gaining unauthorized access to sensitive corporate data, communications, and intellectual property. If exploited, this zero-day flaw could enable cybercriminals to monitor, manipulate, or exfiltrate private information without detection, leading to severe operational disruptions, reputational damage, and regulatory penalties. Any business relying on Android smartphones for daily operations, communication, or data storage remains vulnerable, making it imperative to implement advanced security measures, regular device updates, and vigilant threat monitoring to mitigate such sophisticated threats and protect vital business assets.

Possible Next Steps

Prompted by the increasing sophistication of cyber threats, it is crucial to act swiftly when a zero-day vulnerability, such as the Landfall Android spyware targeting Samsung phones, is discovered. Timely remediation minimizes the window of opportunity for attackers, reduces potential data breaches, and preserves system integrity, thereby safeguarding user privacy and organizational assets.

Containment Strategies

• Isolate affected devices from networks until further analysis is done to prevent spread of malware.
• Disable Bluetooth, Wi-Fi, and other connectivity features that could facilitate malware communication.

Detection Tactics

• Deploy threat detection tools capable of identifying suspicious activities or anomalous behavior indicative of spyware.
• Encourage users to report unusual device behavior promptly for early identification of compromise.

Patch & Update

• Apply manufacturer-released security patches or updates immediately to close exploited vulnerabilities.
• Ensure that all devices are running the latest version of the Android OS and Samsung-specific security updates.

Removal Procedures

• Perform complete device wipes or factory resets on compromised phones, following backup protocols to prevent data loss.
• Use specialized mobile security tools to thoroughly scan and remove spyware components.

Monitoring & Response

• Implement continuous monitoring solutions to track for signs of persistent threats or re-infection attempts.
• Establish an incident response plan tailored to mobile device threats, detailing steps for investigation, communication, and recovery.

User Education

• Conduct awareness sessions on safe mobile practices, such as avoiding suspicious links or untrusted apps.
• Reinforce the importance of timely software updates and cautious handling of device permissions.

Advance Your Cyber Knowledge

Stay informed on the latest Threat Intelligence and Cyberattacks.

Access world-class cyber research and guidance from IEEE.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource