New “LANDFALL” Android Malware Makes use of Samsung 0-Day Vulnerability Hidden in WhatsApp Pictures

Cybersecurity researchers at Unit 42 have uncovered a classy Android spyware and adware marketing campaign that exploited a beforehand unknown zero-day vulnerability in Samsung Galaxy gadgets.

The malware, dubbed LANDFALL, leveraged a essential vulnerability in Samsung’s picture processing library to ship commercial-grade surveillance capabilities by maliciously crafted picture information despatched through WhatsApp.

The LANDFALL marketing campaign exploited CVE-2025-21042, a zero-day vulnerability in Samsung’s Android picture processing library that remained unpatched till April 2025.

Attackers embedded the spyware and adware inside malformed DNG (Digital Unfavourable) picture information, which had been delivered to targets by WhatsApp messages.

The exploitation technique carefully resembles an identical assault chain found concentrating on Apple iOS gadgets in August 2025, highlighting a broader sample of DNG picture processing vulnerabilities being weaponized throughout cell platforms.

Unit 42’s discovery got here throughout their investigation of iOS exploit chains after they recognized a number of suspicious DNG information uploaded to VirusTotal all through 2024 and early 2025.

The filenames, equivalent to “WhatsApp Picture 2025-02-10 at 4.54.17 PM.jpeg” and “IMG-20240723-WA0000.jpg,” strongly recommend the malware was distributed by WhatsApp’s messaging platform. Importantly, researchers discovered no vulnerabilities in WhatsApp itself the applying was merely used as a supply mechanism.

Samsung 0-Day Vulnerability

LANDFALL is particularly designed to focus on Samsung Galaxy gadgets, together with the S22, S23, and S24 sequence, in addition to Z Fold4 and Z Flip4 fashions.

The b.so element of LANDFALL communicates with its C2 server over HTTPS utilizing a non-standard, ephemeral TCP port. 

The spyware and adware permits in depth surveillance capabilities, together with microphone recording, location monitoring, name log assortment, and extraction of photographs, contacts, and SMS messages. Its modular structure suggests it might obtain further parts to increase its performance.

The malware’s loader element, internally known as “Bridge Head,” comprises subtle evasion methods to keep away from detection by safety instruments and debugging frameworks.

Evaluation revealed the spyware and adware might manipulate Android’s SELinux safety insurance policies to take care of elevated permissions and set up persistence on contaminated gadgets.

Proof signifies LANDFALL was deployed in focused intrusion actions inside the Center East, with potential victims recognized in Iraq, Iran, Turkey, and Morocco.

The marketing campaign’s infrastructure and tradecraft patterns share similarities with industrial spyware and adware operations related to non-public sector offensive actors (PSOAs) entities that develop and promote surveillance instruments to authorities shoppers.

Researchers famous potential connections to the Stealth Falcon menace group and potential hyperlinks to the Variston spyware and adware framework, which reportedly operated out of Barcelona earlier than ceasing operations in early 2025.

The b.so file’s configuration is managed by a mixture of hard-coded default values and an encrypted JSON object embedded inside itself. 

The “Bridge Head” naming conference utilized by LANDFALL matches terminology employed by a number of recognized industrial spyware and adware distributors, together with NSO Group and Variston.

Timeline and Present Standing

Unit 42 tracks this exercise as CL-UNK-1054 and continues investigating the marketing campaign’s scope and attribution. Palo Alto Networks prospects obtain safety by Superior WildFire, Superior URL Filtering, Superior DNS Safety, and Superior Risk Prevention merchandise, which have been up to date to detect LANDFALL-related indicators.

The earliest LANDFALL samples appeared in July 2024, months earlier than Samsung addressed the vulnerability in April 2025.

In September 2025, Samsung patched a further associated vulnerability, CVE-2025-21043, additional defending customers from related assault vectors. Samsung customers who’ve utilized safety updates since April 2025 are not in danger from this particular exploit.

Indicators of Compromise

Observe us on Google Information, LinkedIn, and X to Get Prompt Updates and Set GBH as a Most well-liked Supply in Google.