Back Arstechnica

Commercial spyware “Landfall” ran rampant on Samsung phones for almost a year

Arstechnica •Ryan Whitwam • November 7, 2025

Share: View original

Targeted attack could steal all of a phone's data and activate camera or mic.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Landfall Spyware Exploits Samsung Galaxy Zero-Day Vulnerability Landfall, a sophisticated Android spyware, targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability (CVE-2025-21042) in Samsung's image-processing library. The campaign, uncovered by Palo Alto Networks' Unit 42, likely affected users in the Middle East, allowing attackers to install surveillance software without user interaction. The vulnerability was first detected in July 2024 and was patched in April 2025. 47 sources 36

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)