Zero-Click Samsung Zero-Day (CVE-2025-21042) Delivered LANDFALL Spyware Via Malicious DNG Images

Researchers from Unit 42, the threat intelligence team at Palo Alto Networks, have identified a previously unknown Android spyware family dubbed LANDFALL that exploits a zero-day in Samsung’s image processing library to compromise Galaxy devices. The campaign, active since mid-2024 and targeted at Middle Eastern users, hides the spyware inside malicious DNG image files sent via WhatsApp, enabling zero-click infection and full device surveillance.

The attack relies on malformed DNG files containing a ZIP archive with the spyware payload, exploiting a flaw in libimagecodec.quram.so, and, once opened or previewed under certain conditions, triggers the exploit to extract and run shared object binaries.

LANDFALL is described as commercial-grade spyware for Samsung Galaxy models including the S22, S23, S24, Z Fold4 and Z Flip4, delivering capabilities such as recording calls and ambient audio, stealing data, tracking location, and monitoring installed apps, with the b.so and l.so components handling backdoor loading and privilege persistence.

Evidence from VirusTotal and geographic indicators show activity linked to Iraq, Iran, Turkey and Morocco, with C2 infrastructure and codename links suggesting overlap with PSOAs; according to Unit 42, the code name Bridge Head is used in LANDFALL’s debug strings and shares traits with several private-sector groups.