Novel LANDFALL Android spyware exploits Samsung zero-day

High-end Samsung Galaxy phones, including the S22 through S24 devices, Z Fold4, and Z Flip4, impacted by a zero-day vulnerability were subjected to attacks that spread the commercial-grade LANDFALL spyware over a nine-month hacking campaign, reports The Record, a news site by cybersecurity firm Recorded Future.

Malformed Digital Negative images with a ZIP archive embedded at the end of the file were distributed via WhatsApp to exploit the now-patched image processing library flaw in Galaxy devices, tracked as CVE-2025-21042, and launch the Android spyware, an analysis from Palo Alto Networks Unit 42 researchers showed. Attackers then used the potentially zero-click LANDFALL spyware to enable call and microphone recording, SMS and photo gathering, location tracking, and contact and call history theft.

Such malware, which has domain registration patterns and command-and-control infrastructure akin to the United Arab Emirates-linked hacking operation Stealth Falcon, was regarded by Unit 42 senior principal researcher as a "precision attack."

"The sophisticated infrastructure, bespoke payload design, and use of zero-day vulnerabilities are all hallmarks of an espionage-motivated operation, not a financial or consumer-scale campaign," said Cohen.