'Landfall' Malware Targeted Samsung Galaxy Users

A new Android spyware campaign, dubbed Landfall, targeted Samsung Galaxy users in the Middle East by exploiting a zero‑day in Samsung’s image processing library to deliver a commercial‑grade tool. The activity ran from at least mid‑2024 until April 2025, when Samsung fixed the vulnerability after a researcher privately reported it.

Researchers at Palo Alto Networks’ Unit 42 discovered the spyware while following up on public reports of iOS exploits earlier this year, and described Landfall as capable of secretly recording conversations, tracking locations, capturing photos, and exfiltrating contacts and call logs, among other surveillance tasks. The attackers reportedly used a weaponized Digital Negative image file to exploit CVE‑2025‑21042, with targets in Iraq, Iran, Turkey and Morocco receiving the payload via WhatsApp.

Unit 42’s analysis notes the loader and spyware components are modular and that Landfall shows anti‑analysis and privilege‑escalation capabilities, along with at least six command and control servers. According to Unit 42, the framework and infrastructure overlaps with past campaigns linked to Stealth Falcon, though a direct link to the UAE government has not been confirmed.