Tech Desk 
Nov 10, 2025
Samsung Galaxy phones were compromised for almost ten months by an unidentified Android spyware called Landfall, according to a recently discovered cyber-espionage campaign.
The hack took advantage of a critical zero-day vulnerability in Samsung's image-processing library, identified as CVE-2025-21042, which gave attackers the ability to take over devices by sending them a malicious image file, usually through WhatsApp.
The exploit was embedded by the attackers in corrupted Digital Negative (DNG) files that were masquerading as regular JPEG pictures.
Once activated, Landfall could record audio, track GPS location, retrieve contacts, messages, photos, and call logs, as well as turn on the camera and microphone on the device.
There is evidence that the campaign was centred in the Middle East, with victims reported in Morocco, Iran, Iraq, and Turkey.
Instead of describing it as mass-distribution malware, Unit 42 called it a "precision espionage" operation.
The vulnerability remained unpatched until Samsung issued an emergency fix in April 2025, and samples go back to July 2024. Before mitigation, the exploit was in use for about ten months, according to researchers.
In the April 2025 security update, Samsung fixed CVE-2025-21042, resolving the problem. All Galaxy owners have been advised by the company to update their firmware.
Five Samsung models, however, will no longer receive security patches as of November 2025 because their software support has officially ended.
Despite the fact that the current Landfall campaign is thought to be dormant following the patch, this leaves millions of older devices open to future exploits.
More than one billion Android devices worldwide are out of date, according to analysts, which makes them vulnerable to similar zero-day attacks.
Owners of Galaxy devices should confirm that they are running Android 13-15 and that the April 2025 security patch has been applied or later.
Risk can be decreased by turning off WhatsApp and other messaging apps' automatic media downloads. Upgrading to a newer model is the safest option for devices that are no longer supported.
