Newly identified Android spyware appears to be from a commercial vendor

Security researchers uncovered LANDFALL, a sophisticated spyware campaign targeting Samsung Galaxy phones using a zero-day exploit. The campaign appears to be driven by espionage motives, with potential links to Middle Eastern threat actors. #LANDFALL #ZeroDay #SamsungGalaxy #Espionage #MiddleEast

Keypoints

LANDFALL is a commercial-grade spyware used in a targeted hacking campaign against Galaxy phones.
The spyware exploits a zero-day vulnerability in the phones’ image processing libraries, tracked as CVE-2025-21042.
Attackers used malformed DNG images with embedded ZIP archives sent via WhatsApp to exfiltrate data.
The campaign shares infrastructure patterns with spyware linked to Middle Eastern private sector actors and possibly Stealth Falcon.
Targeted devices include Galaxy ZFOLD4, Galaxy ZFlip4, and S22, S23, and S24 series models, with potential targets in Iraq, Iran, Turkey, and Morocco.