Archive · 10 Nov 2025
Spyware Landfall Exploited Samsung Phones Via WhatsApp Image Flaw
Imagine your phone has a secret door that only a few people know about.
Hackers found a way to use this secret door, called Landfall spyware, to sneak into certain Samsung phones.
They didn't even need you to click anything; they just sent a special picture file through apps like WhatsApp.
Once inside, the spyware could look at your photos, read your messages, see who you called, and even listen through your phone's microphone.
Security experts discovered this trick and told Samsung.
Samsung fixed the problem, but it took many months for the fix to be released, leaving phones vulnerable for a long time.
This shows how important it is to keep your phone's software updated.
Researchers also noticed a similar problem affecting iPhones, suggesting that hackers are finding new ways to spy on phones using picture files.
A new spyware called Landfall exploited a zero-day vulnerability (CVE-2025-21042) in Samsung's image-processing library.
Attackers used malformed DNG image files, disguised as regular pictures, sent via WhatsApp to achieve zero-click attacks.
The spyware targeted specific Samsung Galaxy models (S22, S23, S24, Z Fold 4, Z Flip 4) and other Galaxy devices running Android 13-15.
Landfall was capable of stealing sensitive data including photos, contacts, call logs, and could track location and use the microphone.
While detected in July 2024 and patched by Samsung in April 2025, the vendor behind Landfall remains unknown, with campaigns primarily targeting the Middle East.
- Who
- Hackers (vendor unknown) and cybersecurity firm Unit 42 (part of Palo Alto Networks)
- What
- A spyware campaign named Landfall exploited a zero-day vulnerability (CVE-2025-21042) in Samsung's image-processing library, using malformed DNG image files sent via WhatsApp to infect devices without user interaction.
- When
- The spyware was first detected in July 2024, Samsung was notified in September 2024, and a patch was released in April 2025.
- Where
- Targeted individuals in the Middle East, specifically noted in Morocco, Iran, Iraq, and Turkey.
- Why
- To carry out comprehensive surveillance, stealing data like photos, contacts, and call logs, and to covertly use the device's microphone and track location.
Samsung's Action
Researcher's Concern
Vulnerability Patch Timeline
Samsung's Action
Samsung was informed about the vulnerability in September 2024 and released a patch in April 2025.
Researcher's Concern
The significant time gap between Samsung being notified and the patch release left millions of devices vulnerable for months.
- Spyware Name
- Landfall
- Vulnerability Identifier
- CVE-2025-21042
- Exploited File Type
- Malformed DNG image files
- Attack Vector
- WhatsApp messages
- Attack Type
- Zero-click
- Affected Devices
- Samsung Galaxy S22, S23, S24, Z Fold 4, Z Flip 4, and other Galaxy devices running Android 13-15
- Targeted Regions
- Middle East (including Morocco, Iran, Iraq, and Turkey)
- Detection Date
- July 2024
- Notification to Samsung
- September 2024
- Patch Release Date
- April 2025