Archive · 11 Nov 2025
Samsung Galaxy Phones Targeted by New Landfall Spyware
Imagine your phone is like a house with a special door for looking at pictures.
Some sneaky people found a way to sneak through this picture door without you even knowing, by sending a special kind of picture file.
Once inside, they could put spy software, called Landfall, on your phone.
This spy software could let them see what you're doing.
This happened to many Samsung phones, especially in the Middle East.
Samsung didn't know about this trick at first, but they found out and fixed the picture door in April of next year so it can't happen anymore.
This trick was so clever that it's called a 'zero-day' attack because the company didn't know about the problem until it was already being used.
Samsung Galaxy phones are at risk due to a new spyware called Landfall.
Hackers exploited a zero-day vulnerability in Samsung's image processing library to deploy the spyware.
The spyware, Landfall, was delivered through malformed DNG image files without requiring user interaction.
Targeted phones include specific Galaxy S and Z models, and others running Android 13-15.
Samsung patched the vulnerability in April 2025, though the spyware was active before its discovery in July 2024.
- Who
- Hackers using Landfall spyware, identified by Unit 42 of Palo Alto Networks.
- What
- Exploitation of a zero-day vulnerability in Samsung Galaxy phones to install Landfall spyware.
- When
- The spyware was first identified in July 2024 and had been active for months. Samsung patched the vulnerability in April 2025.
- Where
- Worldwide, with most exploited victims identified in the Middle East. Affects Samsung Galaxy phones running Android 13-15.
- Why
- To deploy spyware on victim devices without requiring any action from the user.
Exploitation of Vulnerability
Mitigation and Patching
Discovery and Impact
Exploitation of Vulnerability
Hackers exploited a zero-day vulnerability in Samsung's image processing library (CVE-2025-21042) to deploy Landfall spyware.
Mitigation and Patching
Samsung patched the security flaw in April 2025, after the spyware was identified in July 2024 and had been active.
Attack Vector
Exploitation of Vulnerability
The spyware was delivered through malformed DNG image files, even via apps like WhatsApp, without victim interaction.
Mitigation and Patching
The vulnerability was exploited in the wild before being patched.
Scope
Exploitation of Vulnerability
Five Galaxy phone models, including S23, S22, S24, and some Galaxy Z models, were identified as potential targets. Other Galaxy phones running Android 13-15 were also vulnerable.
Mitigation and Patching
Samsung addressed the critical zero-day vulnerability.
- Spyware Name
- Landfall
- Vulnerability Type
- Zero-day exploit in Samsung's image processing library
- Vulnerability ID
- CVE-2025-21042
- Attack Method
- Malformed DNG image files
- Affected Devices (Potential)
- Samsung Galaxy S23, S22, S24, certain Galaxy Z models, and other Galaxy phones running Android 13-15
- Primary Victim Region
- Middle East
- Patch Date
- April 2025
- Discovery Date
- July 2024