Samsung Zero-Click Flaw Exploited to Deploy LANDFALL Android Spyware via WhatsApp

Samsung Galaxy Android devices were exploited with a zero-day to deliver a “commercial-grade” Android spyware named LANDFALL in targeted Middle East attacks, with Unit 42 attributing the flaw to CVE-2025-21042 (CVSS 8.8) and noting it was an out-of-bounds write in libimagecodec.quram.so that could allow remote code execution.

The activity reportedly involved sending malicious DNG images via WhatsApp, and LANDFALL samples trace back to at least July 23, 2024, with embedded ZIP archives used to load a shared object and manipulate SELinux to gain persistence. It is described as being patched by Samsung in April 2025, after in-the-wild attacks were observed, and VirusTotal data suggests potential targets in Iraq, Iran, Turkey, and Morocco.

The attack chain is said to be near zero-click, triggering CVE-2025-21042 exploitation without user interaction, and LANDFALL then operates as a full spy tool collecting microphone recordings, location, photos, contacts, SMS, files, and call logs, with a C2 beacon over HTTPS. While the exact developers remain unidentified, Unit 42 notes the C2 patterns align with Stealth Falcon (FruityArmor) in some aspects, though no direct overlaps have been confirmed as of October 2025.