Landfall Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
45
occurrences
First Seen
November 7, 2025
Last Seen
November 29, 2025

Related Threat Clusters

  • Landfall Spyware Exploits Samsung Galaxy Zero-Day Vulnerability

    A sophisticated spyware named 'Landfall' targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability in Samsung's image-processing library. Discovered by Palo Alto Networks' Unit 42, the…

    15 articles · Updated November 12, 2025
  • Landfall Spyware Exploits Samsung Galaxy Zero-Day Vulnerability

    A sophisticated spyware named Landfall targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability in Samsung's image processing library. Discovered by Palo Alto Networks' Unit 42, the malware…

    37 articles · Updated November 12, 2025
  • ClickFix Malware Campaign Enhances Deception Tactics

    The ClickFix malware has evolved to utilize videos, countdown timers, and OS detection to trick users into self-infecting their devices. Cybercriminals employ social engineering techniques to manipulate victims into…

    2 articles · Updated November 7, 2025
  • New Android Malware 'Sturnus' Steals Banking Credentials and Encrypted Chats

    Cybersecurity researchers have identified a new Android banking trojan named Sturnus, capable of stealing banking credentials and accessing encrypted messages from apps like WhatsApp, Telegram, and Signal. The malware…

    48 articles · Updated December 2, 2025
  • Cisco Faces Multiple Critical Vulnerabilities in Unified CCX and Firewalls

    Cisco has disclosed critical vulnerabilities in its Unified Contact Center Express (CCX) platform and Adaptive Security Appliances (ASA) that allow unauthenticated remote attackers to execute arbitrary code and…

    10 articles · Updated November 10, 2025
  • Herodotus Android Trojan Mimics Human Behavior to Evade Detection

    The Herodotus Android Trojan has emerged as a sophisticated banking malware that mimics human typing to evade detection by security systems. It is capable of stealing credentials, logging keystrokes, and intercepting…

    7 articles · Updated November 7, 2025
  • Landfall Spyware Exploits Samsung Galaxy Zero-Day Vulnerability

    Landfall, a sophisticated Android spyware, targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability (CVE-2025-21042) in Samsung's image-processing library. The campaign, uncovered by Palo…

    47 articles · Updated November 10, 2025
  • Hackers Exploit WhatsApp Images to Spy on Samsung Galaxy Users

    Hackers utilized a vulnerability in Samsung Galaxy devices to deploy spyware called Landfall, which exploited an image flaw in WhatsApp. The attack affected users running Android 13 to 15, with the security patch only…

    3 articles · Updated November 9, 2025
  • CISA Adds Samsung Mobile Vulnerability CVE-2025-21042 to Exploited Catalog

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Samsung mobile devices vulnerability, tracked as CVE-2025-21042, to its Known Exploited Vulnerabilities catalog. This flaw, which has a CVSS…

    2 articles · Updated November 11, 2025
  • CISA Warns of Spyware Targeting Signal and WhatsApp Accounts

    CISA has issued a warning regarding state-backed and mercenary threat actors using commercial spyware to compromise Signal and WhatsApp accounts. These groups employ phishing, fake QR codes, malicious app impersonation,…

    12 articles · Updated November 25, 2025

Recent Intelligence Reports

  • Password-stealing virus detected on Android phones - Zamin.uz, 29.11.2025 — Zamin.Uz · November 29, 2025
  • State-backed spyware attacks are targeting Signal and WhatsApp users, CISA warns — Grahamcluley · November 27, 2025
  • CISA warns spyware crews are breaking into Signal and WhatsApp accounts — Theregister · November 25, 2025
  • Security Affairs newsletter Round 550 by Pierluigi Paganini — Securityaffairs · November 16, 2025
  • CISA warns feds to fully patch actively exploited Cisco flaws — Bleepingcomputer · November 13, 2025
  • Samsung phones infected with 'Landfall' spyware through WhatsApp images - Tom's Guide — Tomsguide · November 12, 2025
  • CVE-2025-21042: Samsung Galaxy Zero — Socradar · November 11, 2025
  • What is 'Landfall' spyware, and how was it used to target Samsung Galaxy phones? — Indianexpress · November 11, 2025

CVSS v3.1 Breakdown