Home
Mobiles
Mobiles News
Samsung Galaxy Smartphones Targeted By Spyware Landfall for Over a Year

Samsung Galaxy Smartphones Targeted By Spyware Landfall for Over a Year

Once activated, the spyware Landfall can record audio, read messages, and copy data without detection.

Written by Akash Dutta, Edited by Ketan Pratap | Updated: 11 November 2025 12:05 IST

Samsung Galaxy Smartphones Targeted By Spyware Landfall for Over a Year

Samsung patched the vulnerability in April

Click Here to Add Gadgets360 As A Trusted Source

Highlights

The spyware is said to be targeting specific Samsung Galaxy phones
It exploited a flaw in the phone’s photo library’s image processing
The vulnerability was tracked as CVE-2025-21042

Samsung Galaxy smartphones were reportedly vulnerable to a new Android Spyware dubbed Landfall for more than a year. As per the report, the malware can be spread via seemingly normal images shared over social media apps, and targeted image parsing in the device's library. The report mentions that it is a commercial-grade malware that specifically focuses on a zero-day vulnerability on specific Galaxy models. The South Korean tech giant addressed the flaw earlier this year, but the spyware was reportedly active for more than 12 months before that.

Landfall Spyware Targets Samsung Galaxy Phones

The sophisticated spyware attack was first uncovered by cybersecurity researchers at Unit 42, the threat intelligence arm of Palo Alto Networks. The spyware was found hidden inside image files and used an unpatched vulnerability to secretly take control of affected devices.

At the heart of the attack was a zero-day vulnerability in Samsung's image-processing library. A zero-day refers to a security flaw that the manufacturer is not yet aware of, leaving users defenceless until a patch is released. In this case, the bug allowed attackers to embed malicious code inside DNG image files, a format commonly used by professional cameras for storing raw photos.

Report Links $16 Billion of Meta’s 2024 Revenue to Fraudulent Ads

To break it down, all it requires to get infected with the malware is to receive a message. It can be downloaded from an app, received via email, or shared in a group on an instant messaging platform. As soon as the image has been downloaded on the device, the attack begins. The image file secretly carries a trapdoor that, when opened by your phone's image viewer, installs a hidden spy programme in the background. That's essentially how Landfall worked.

Once triggered, the spyware unpacked two hidden components: one acted as a loader to start the infection, while the other tampered with the phone's SELinux policy, a key Android security feature that controls what apps can and cannot do. By altering it, the spyware gave itself elevated permissions to record audio, read messages, and copy data without detection.

The malware was mainly found targeting Samsung Galaxy S22, Galaxy S23, and Galaxy S24 series, as well as the Z Fold 4 and Z Flip 4 models. Unit 42's analysis of uploaded samples suggests that the campaign may have begun in mid-2024 and continued into early 2025 before it was exposed. Most of the affected devices appeared to be in the Middle East, including Iraq, Iran, Turkey, and Morocco.

Samsung patched the exploited vulnerability, tracked as CVE-2025-21042, in its April security update. A related image-processing flaw, CVE-2025-21043, was also fixed in September. Users who have not updated their phones since early this year are urged to do so immediately.

Samsung Galaxy S24

REVIEW
KEY SPECS
NEWS

Design
Display
Software
Performance
Battery Life
Camera
Value for Money

Good
Compact design
Vibrant 120Hz display
Capable processor
Good overall camera performance

Bad
Average battery life
Recycled design
AI features free till 2025

Read detailed Samsung Galaxy S24 review

Display 6.20-inch

Processor octa-core

Front Camera 12-megapixel

Rear Camera 50-megapixel + 12-megapixel + 10-megapixel

RAM 8GB

Storage 128GB, 256GB, 512GB

Battery Capacity 4000mAh

OS Android 14

More Samsung mobiles Samsung mobiles price in India

Samsung Galaxy S23

REVIEW
KEY SPECS
NEWS

Design
Display
Software
Performance
Battery Life
Camera
Value for Money

Good
Compact design that?s hard to beat
Long-term software update commitment
Good performance, effective heat management
All-day battery life
IP68 rated

Bad
Only minor design changes
Relatively slow charging

Read detailed Samsung Galaxy S23 review

Display 6.10-inch

Processor Snapdragon 8 Gen 2

Front Camera 12-megapixel

Rear Camera 50-megapixel + 12-megapixel + 10-megapixel

RAM 8GB

Storage 128GB, 256GB

Battery Capacity 3,900mAh

OS Android 13

More Samsung mobiles Samsung mobiles price in India

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Samsung, cybersecurity, data privacy, malware, spyware

Akash Dutta Email Akash Dutta

Akash Dutta is a Chief Sub Editor at Gadgets 360. He is particularly interested in the social impact of technological developments and loves reading about emerging fields such as AI, metaverse, and fediverse. In his free time, he can be seen supporting his favourite football club - Chelsea, watching movies and anime, and sharing passionate opinions on food. More