LANDFALL Spyware Hits Samsung Phones — Trusted Devices Turn System-Wide Threat
A second LANDFALL campaign quietly drilled into Samsung Galaxy S22/S23/S24 and Z-series phones for months — disguised DNG images exploited CVE-2025-21042 to install keyloggers, mic taps and full data exfiltration with zero user interaction.
LANDFALL Spyware Penetrates Samsung Galaxy Phones
Security researchers discovered a sophisticated campaign targeting Samsung Galaxy devices via a zero-day vulnerability in the manufacturer’s image-processing library. The spyware — dubbed LANDFALL — exploited this flaw to silently infiltrate phones, deploy keylogging, audio recording and full data exfiltration modules.
How the Attack Worked
- Malicious DNG image files: Crafted DNG files (disguised as JPEGs) were delivered via messaging apps and exploited CVE-2025-21042.
- Silent execution: Opening the media triggered the image library exploit, executing payloads and installing spyware with no user interaction.
- Wide device coverage: Impacted devices include Galaxy S22, S23, S24 and Z-series models across targeted regions.
Why This Is Dangerous
Devices are trusted platforms; when a low-level image-processing component is compromised, attackers gain a stealthy, persistent foothold. LANDFALL enabled continuous surveillance — capturing credentials, sensor feeds, location, microphone and more.
The campaign ran silently for months (mid-2024 to early-2025) before being publicly exposed.
What You Can Do
- Install the latest Samsung software update immediately.
- Avoid opening unexpected image files or APKs received through messaging apps.
- Enable encryption + strong screen lock (PIN/biometric).
- Use mobile threat protection if available.
- Review app permissions (camera, mic, storage, location).
