InfoSecBulletin Cybersecurity for mankind
Security researchers found Android spyware that targeted Samsung Galaxy phones for almost a year. Researchers at Palo Alto Networks’ Unit 42 said the spyware, which they call “Landfall,” was first detected in July 2024 and relied on exploiting a security flaw in the Galaxy phone software that was unknown to Samsung at the time, a type of vulnerability known as a zero-day.
Unit 42 reported that a flaw can be exploited by sending a harmful image to a victim’s phone, possibly via a messaging app, potentially without any victim interaction.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Samsung patched the security flaw — tracked as CVE-2025-21042 — in April 2025, but details of the spyware campaign abusing the flaw have not been previously reported.
Researchers stated in a blog post that the creator of the Landfall spyware is unknown, as is the number of individuals targeted. They believe the attacks likely focused on people in the Middle East.
TechCrunch quoted Itay Cohen, a senior principal researcher at Unit 42 that the hacking campaign consisted of a “precision attack” on specific individuals and not a mass-distributed malware, which indicates that the attacks were likely driven by espionage.
Unit 42 discovered that the Landfall spyware uses some of the same digital infrastructure as Stealth Falcon, a surveillance vendor involved in spyware attacks against Emirati journalists and activists since 2012. However, researchers concluded that these connections alone do not definitively link the attacks to a specific government.
Unit 42 said that the Landfall spyware samples that they discovered had been uploaded to VirusTotal, a malware scanning service, from individuals in Morocco, Iran, Iraq, and Turkey throughout 2024 and early 2025.
Turkey’s national cyber readiness team, USOM, identified one of the IP addresses linked to the Landfall spyware as malicious. Unit 42 suggests this indicates possible targeting of individuals in Turkey.
Landfall, like other government spyware, can extensively surveil devices. It can access photos, messages, contacts, call logs, tap the microphone, and track precise locations.
Unit 42 discovered that the spyware targeted five Galaxy phones, including the S22, S23, S24, and some Z models. Cohen indicated that the vulnerability could also affect other Galaxy devices running Android versions 13 to 15.
Samsung did not respond to a request for comment.
