InfoSecBulletin Cybersecurity for mankind
Security researchers found Android spyware that targeted Samsung Galaxy phones for almost a year. Researchers at Palo Alto Networks’ Unit 42 said the spyware, which they call “Landfall,” was first detected in July 2024 and relied on exploiting a security flaw in the Galaxy phone software that was unknown to Samsung at the time, a type of vulnerability known as a zero-day.
Unit 42 reported that a flaw can be exploited by sending a harmful image to a victim’s phone, possibly via a messaging app, potentially without any victim interaction.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Samsung patched the security flaw — tracked as CVE-2025-21042 — in April 2025, but details of the spyware campaign abusing the flaw have not been previously reported.
Researchers stated in a blog post that the creator of the Landfall spyware is unknown, as is the number of individuals targeted. They believe the attacks likely focused on people in the Middle East.
TechCrunch quoted Itay Cohen, a senior principal researcher at Unit 42 that the hacking campaign consisted of a “precision attack” on specific individuals and not a mass-distributed malware, which indicates that the attacks were likely driven by espionage.
Unit 42 discovered that the Landfall spyware uses some of the same digital infrastructure as Stealth Falcon, a surveillance vendor involved in spyware attacks against Emirati journalists and activists since 2012. However, researchers concluded that these connections alone do not definitively link the attacks to a specific government.
Unit 42 said that the Landfall spyware samples that they discovered had been uploaded to VirusTotal, a malware scanning service, from individuals in Morocco, Iran, Iraq, and Turkey throughout 2024 and early 2025.
Turkey’s national cyber readiness team, USOM, identified one of the IP addresses linked to the Landfall spyware as malicious. Unit 42 suggests this indicates possible targeting of individuals in Turkey.
Landfall, like other government spyware, can extensively surveil devices. It can access photos, messages, contacts, call logs, tap the microphone, and track precise locations.
Unit 42 discovered that the spyware targeted five Galaxy phones, including the S22, S23, S24, and some Z models. Cohen indicated that the vulnerability could also affect other Galaxy devices running Android versions 13 to 15.
Samsung did not respond to a request for comment.
