Archive — US — techcrunch
‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones
Security researchers discovered a zero-day vulnerability exploited by 'Landfall' spyware to hack Samsung Galaxy phones, targeting individuals in the Middle East. The spyware was first detected in July 2024 and utilized malicious images sent via messaging apps. Samsung patched the vulnerability in April 2025, but the campaign's extent and origin remain uncertain, with links to previous surveillance tactics against journalists.
Key points
- 1. 'Landfall' spyware detected in July 2024, targeting Samsung Galaxy phones.
- 2. Exploits a zero-day vulnerability in Galaxy phone software (CVE-2025-21042).
- 3. Malicious images delivered via messaging apps may not require user interaction.
- 4. Samsung issued a patch in April 2025; the spyware campaign previously unreported.
- 5. The campaign likely aimed at individuals in the Middle East; specifics on victims unclear.
- 6. Links to the Stealth Falcon surveillance vendor, known for targeting activists and journalists since 2012.
- 7. Malicious IP flagged by Turkey’s cyber readiness team suggests potential targeting there.
- 8. Spyware capable of extensive surveillance: accessing messages, photos, contacts, and location.
Why it matters
- 1. The prevalence of government-sponsored spyware reflects ongoing global espionage trends.
- 2. Similar tactics have been used against journalists and activists worldwide, raising concerns about privacy.
- 3. Increased attention on Android security indicates a need for vigilance in software vulnerability management.
- 4. Links to previous spyware campaigns highlight historical patterns of surveillance and cyber warfare.
The discovery of 'Landfall' spyware illustrates the ongoing risks associated with mobile device vulnerabilities, emphasizing the importance of prompt security measures and the protection of individual privacy from targeted espionage.