Loading story…
Security researchers uncovered a sophisticated Android spyware campaign, dubbed LANDFALL, which specifically targeted Samsung Galaxy devices using a previously unknown zero-day vulnerability (CVE-2025-21042) in the image processing library. Attackers delivered the spyware through malicious DNG image files, likely sent via WhatsApp, enabling comprehensive surveillance capabilities such as microphone recording, location tracking, call and message exfiltration, and more. The campaign, believed to have operated primarily in the Middle East, was characterized by its precision targeting and use of advanced tradecraft, including zero-click exploitation and infrastructure patterns reminiscent of commercial spyware vendors. Samsung patched the vulnerability in April 2025, mitigating ongoing risk for current users.
The LANDFALL operation was not a mass malware campaign but a targeted espionage effort, with researchers noting similarities to other commercial-grade spyware activities in the region. The vendor and government sponsor behind LANDFALL remain unidentified, and the full scope of affected individuals is unclear. The campaign's infrastructure and domain registration patterns suggest possible links to known threat actors, but attribution remains unconfirmed. Researchers emphasize that the operation predates other high-profile exploit chains involving similar vulnerabilities, highlighting the evolving threat landscape for mobile device users, especially those in sensitive regions or roles.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On November 10, 2025, CISA added Samsung flaw CVE-2025-21042 to its Known Exploited Vulnerabilities catalog after public reporting on its use in LANDFALL spyware attacks. CISA ordered U.S. federal civilian agencies to remediate the issue under BOD 22-01 and set a deadline of December 1, 2025.
On November 7, 2025, Palo Alto Networks Unit 42 published research on the previously unknown LANDFALL Android spyware family and its exploit chain targeting Samsung Galaxy devices. The report described modular spyware capabilities, six C2 endpoints, likely victim geography including Iraq, Iran, Turkey, and Morocco, and possible WhatsApp-based zero-click delivery via malformed DNG files.
By October 2025, Unit 42 had assessed that LANDFALL infrastructure and registration patterns resembled activity associated with Stealth Falcon and other Middle East commercial spyware ecosystems, but it had not found direct overlap sufficient for attribution. The operation remained unattributed despite these similarities.
Samsung later fixed a second DNG parsing vulnerability in the same image-processing library, tracked as CVE-2025-21043 / SVE-2025-1702, in September 2025. Unit 42 said it found no evidence that LANDFALL used this second flaw.
Apple patched CVE-2025-43300, a similar DNG image-processing vulnerability in iOS, in August 2025. Multiple reports said this helped prompt further scrutiny of Samsung's image parsing issues and highlighted a broader pattern of DNG-based mobile exploitation.
Samsung patched the exploited out-of-bounds write vulnerability CVE-2025-21042 in libimagecodec.quram.so in April 2025. The flaw had been used to deliver LANDFALL spyware through crafted DNG images, likely via WhatsApp and potentially in a zero-click chain.
According to later reporting, Samsung received a report from Meta and the WhatsApp Security Teams about the libimagecodec.quram.so flaw CVE-2025-21042 after it had been exploited in the wild. This private disclosure preceded Samsung's fix.
Palo Alto Networks Unit 42 said it observed artifacts tied to the LANDFALL Android spyware operation in public repositories as early as July 2024, indicating the campaign was active by then. The activity targeted Samsung Galaxy devices, primarily in the Middle East, using malicious DNG image files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesocradar.io
Open sourcescworld.com
Open sourcethecyberthrone.in
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated Android spyware campaign, identified as "LANDFALL," exploited a zero-day remote code execution vulnerability in a widely used image-processing library on major Android devices. Attackers delivered the spyware through malicious DNG image files, often sent via messaging apps, enabling a zero-click exploit chain that bypassed traditional antivirus defenses. Once installed, the spyware gained extensive access to device resources, including the microphone, location data, call logs, photos, and contacts, highlighting the increasing risk posed by advanced mobile threats targeting both personal and business data on smartphones. Security researchers emphasize the critical need for organizations to prioritize timely patching of mobile endpoints, monitor for anomalous device behavior, and enforce robust mobile security policies, especially in BYOD and hybrid environments. The incident demonstrates how mobile devices have become primary targets for high-stakes espionage and underscores the importance of continuous threat monitoring and improved user security hygiene to mitigate the risk of compromise from sophisticated, zero-day-driven attacks.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026