Landfall Spyware Targets Samsung Users in Middle East

Security researchers have uncovered a sophisticated spyware campaign that targeted Samsung Galaxy smartphone users in the Middle East, exploiting a previously unknown vulnerability to install surveillance software without user interaction. The operation, active since at least July 2024, relied on a zero-day flaw in Samsung's Android image processing library and affected select devices until the company patched it in April 2025.

The spyware, dubbed Landfall by analysts at Palo Alto Networks' Unit 42, was delivered through malicious Digital Negative (DNG) image files sent via WhatsApp. These files, which appear as ordinary photos, contained embedded ZIP archives with malicious code. The vulnerability, cataloged as CVE-2025-21042, involved an out-of-bounds write in the libimagecodec.quram.so component, earning a critical severity score of 8.8. It allowed remote attackers to execute arbitrary code on affected devices, enabling the spyware's installation in a zero-click manner that required no victim engagement.

Unit 42 researchers identified the threat after examining samples uploaded to the VirusTotal malware scanning platform, starting from July 23, 2024. Filenames in the samples,...