New “LANDFALL” Android Malware Uses Samsung 0-Day Vulnerability Hidden in WhatsApp Images

Cybersecurity researchers at Unit 42 have uncovered LANDFALL, an Android spyware campaign that exploits a previously unknown zero-day in Samsung’s image processing library to deliver surveillance capabilities via maliciously crafted DNG images sent over WhatsApp.

The campaign uses the vulnerability CVE-2025-21042, which remained unpatched until April 2025, and the malware is designed to target Samsung Galaxy devices—including the S22, S23 and S24 series as well as Z Fold4 and Z Flip4—with a loader dubbed “Bridge Head” and a modular architecture capable of downloading additional components.

Its capabilities reportedly include microphone recording, location tracking, call log collection and extraction of photos, contacts and SMS messages, with the b.so component communicating with a C2 server over HTTPS on a non-standard port.

Evidence indicates LANDFALL was deployed in targeted intrusions in the Middle East, with potential victims identified in Iraq, Iran, Turkey and Morocco, and researchers note possible links to private sector spyware operations and to groups such as Stealth Falcon and the Variston framework. According to Unit 42, the earliest LANDFALL samples appeared in July 2024, and Samsung addressed the vulnerability in April 2025, with a related patch for CVE-2025-21043 issued in September 2025.