LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

LANDFALL is a previously unknown Android spyware family described by Unit 42 researchers as being designed for targeting Samsung Galaxy devices. The campaign exploited a zero-day in Samsung’s image processing library (CVE-2025-21042), which Samsung patched in April 2025; a separate but related vulnerability (CVE-2025-21043) was patched in September 2025.

LANDFALL was embedded in malformed DNG image files that appeared to be sent via WhatsApp, with samples first appearing on VirusTotal in mid‑2024 and activity continuing into 2025. The spyware lineage is capable of microphone and location recording, and gathering photos, contacts and call logs, among other data, and is delivered through an exploit chain that may involve zero-click delivery.

Unit 42 notes that the campaign shares infrastructure and tradecraft with commercial spyware operations in the Middle East and discusses possible links to private-sector offensive actors, while stopping short of a definitive attribution. According to Unit 42, while the vulnerability has been patched, the research provides valuable insight into a large‑scale, commercial‑grade intrusion framework.