Samsung Knox is a technology platform tracked across 3 threat clusters and 3 intelligence report mentions on ThreatCluster. First observed November 9, 2025; most recent activity June 24, 2026.
Samsung Knox is Samsung’s hardware-backed security platform integrated into Galaxy devices, offering features such as secure boot, trusted execution environments, and containerization for work data. The recent reporting on Landfall Spyware highlights a stealthy campaign targeting Samsung Galaxy devices, underscoring the ongoing risk to mobile security and the potential implications for Knox-protected environments in enterprise mobility.
Active exploitation of two critical vulnerabilities has been reported: CVE-2026-20230 in Cisco Unified CM and CVE-2026-20971 in Samsung KNOX. The Cisco flaw, a server-side request forgery (SSRF), poses an immediate…
A sophisticated spyware named Landfall targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability in Samsung's image processing library. Discovered by Palo Alto Networks' Unit 42, the malware…
Landfall, a sophisticated Android spyware, targeted Samsung Galaxy phones for nearly a year, exploiting a zero-day vulnerability (CVE-2025-21042) in Samsung's image-processing library. The campaign, uncovered by Palo…