Researchers at Palo Alto Networks have uncovered a new Android spyware dubbed “LANDFALL” that exploited a zero-day vulnerability in Samsung’s image processing library to target victims in the Middle East, highlighting the growing threat of commercial spyware.
Article contents:
- The growing threat of commercial spyware
- Discovery of “Landfall” and the zero-day vulnerability
- Attack mechanism: malicious images via WhatsApp
- Comprehensive espionage capabilities of Landfall spyware
- Timeline and security response
- Implications and future risks
- Frequently asked questions
The growing threat of commercial spyware
The digital world is witnessing a concerning surge in the use of sophisticated commercial spyware, often developed by private companies and sold to various entities, including governments or other threat actors. This software is designed to compromise mobile devices with complete confidentiality, exploiting unknown vulnerabilities to manufacturers (zero-day flaws) and granting attackers near-complete access to victims’ data and communications. These attacks pose a severe threat to privacy and individual and national security, requiring continuous vigilance from security researchers and technology companies.
Discovery of “Landfall” and the zero-day vulnerability
The Palo Alto Networks research team uncovered a new Android spyware family named “Landfall.” Attackers relied on exploiting a zero-day vulnerability in Samsung’s image processing library to deploy this software. This vulnerability, later designated as CVE-2025-21042, was actively exploited in targeted compromise campaigns in the Middle East before Samsung could identify it and issue a patch. This discovery indicates that the vulnerability is not an isolated incident, but part of a broader pattern of similar weaknesses observed across multiple mobile platforms.
Attack mechanism: malicious images via WhatsApp
Palo Alto Networks’ analysis revealed a sophisticated and concerning distribution mechanism. Landfall spyware was embedded within malicious DNG (digital raw image format) files, which appear to have been sent to victims via WhatsApp. Evidence suggests that the exploit chain may have relied on a zero-click delivery, meaning the device could be infected simply by receiving the malicious image without requiring any user interaction, such as opening the image or clicking a link. This method significantly increases the severity of the attack and makes detection much more difficult. The analysis has not recorded any new unknown vulnerabilities in the WhatsApp application itself, indicating that the exploitation occurred at the operating system or device library level.
Comprehensive espionage capabilities of Landfall spyware
Landfall spyware was specifically designed to target Samsung Galaxy devices and featured comprehensive espionage capabilities that grant attackers extensive control over the compromised device. These capabilities include:
- Audio eavesdropping: Secretly recording audio via the device microphone, enabling surveillance of surrounding conversations.
- Location tracking: Tracking the victim’s geographical location accurately and in real-time.
- Data exfiltration: Extracting images and media stored on the device.
- Contact information theft: Extracting contacts and call logs, providing a map of the victim’s relationship network.
Landfall spyware remained active and undetected for a period spanning several months, highlighting its high level of sophistication and evasion capabilities.
Timeline and security response
According to Palo Alto Networks research, the Landfall campaign effectively launched in mid-2024, exploiting the zero-day vulnerability months before Samsung issued the necessary security patch in April 2025. This means users were exposed to risk for a prolonged period without their knowledge. Following the release of the patch in April 2025, updated Samsung users were no longer vulnerable to this specific flaw. In September of the same year, Samsung issued another security update to address a new zero-day vulnerability in the same image processing library, further strengthening the protection level.
Implications and future risks
The Landfall campaign shares infrastructure patterns and tactics with previous commercial spyware operations observed in the region, strongly suggesting its connection to private-sector threat actors specializing in the sale of these tools. This discovery underscores the urgent need for users to regularly update their devices as soon as security updates become available, and for manufacturers to increase their efforts in scanning and testing their software, especially libraries handling untrusted inputs such as image files received via messaging apps.
Frequently asked questions
Q: What is a zero-day vulnerability?
A: It is a security flaw in software or an operating system unknown to the developer or manufacturer, exploited by attackers before a patch can be developed and released.
Q: What is a zero-click attack?
A: It is an advanced type of cyberattack where a device can be compromised simply by receiving a malicious message or file, without requiring any user interaction (such as clicking or opening).
Q: How can I protect my device from such attacks?
A: The most important step is to ensure you install the latest security updates released by the manufacturer (such as Samsung and Google) as soon as they become available, and exercise caution when dealing with files received from unknown sources.
