Commercial spyware “Landfall” ran rampant on Samsung phones for almost a year

Researchers from Unit 42, the threat intelligence arm of Palo Alto Networks, say a sophisticated spyware known as “Landfall” targeted Samsung Galaxy phones and could steal a phone’s data or activate the camera or mic. The campaign used a zero-day in Samsung Android software and was active for almost a year, first appearing in July 2024, with a vulnerability now catalogued as CVE-2025-21042.

Samsung issued a patch in April 2025, and the attackers reportedly delivered the malware via modified DNG image files sent through messaging apps such as WhatsApp, with the exploit able to run without user interaction. The malware can exfiltrate a wide range of data and even alter SELinux policies to gain expanded permissions, enabling comprehensive surveillance.

Unit 42 notes the attack targeted specific Samsung models including the Galaxy S22, S23, S24, Galaxy Z Flip 4, and Galaxy Z Fold 4, and the activity was observed in Iraq, Iran, Turkey and Morocco before the patch, while the broader campaign’s authors remain unclear. Anyone with a supported Samsung phone should ensure they are on the April 2025 patch or later.