Landfall Android Spyware Targeted Samsung Phones via Zero-Day

According to Palo Alto Networks, a recently discovered Android spyware named Landfall was delivered to Samsung device owners by exploiting a zero-day vulnerability, CVE-2025-21042, in a Samsung image processing library to achieve remote code execution. The attackers purportedly sent a specially crafted DNG image via WhatsApp to target devices, with the aim of mounting a zero-click exploitation against Samsung Galaxy phones.

Landfall is capable of microphone recording, location tracking, data exfiltration, and stealing photos, contacts, and call logs on infected devices, including the Galaxy S22, S23, S24, Z Fold4, and Z Flip4. Samsung patched CVE-2025-21042 in April, but its advisory did not confirm in-the-wild exploitation.

Palo Alto Networks says the Landfall attacks have been ongoing since at least July 2024, and the threat actor behind CVE-2025-21042 is being tracked as CL-UNK-1054; connections to UAE-linked Stealth Falcon have been suggested but not conclusive, and other potential developers such as NSO, Variston, and Cytrox have been mentioned.