'Landfall' spyware and adware abused zero-day to hack Samsung Galaxy telephones

[ad_1] Safety researchers have found an Android spyware and adware that focused Samsung Galaxy telephones throughout an almost year-long hacking marketing campaign.

Researchers at Palo Alto Networks’ Unit 42 stated the spyware and adware, which they name “Landfall,” was first detected in July 2024 and relied on exploiting a safety flaw within the Galaxy telephone software program that was unknown to Samsung on the time, a sort of vulnerability referred to as a zero-day.

Unit 42 stated the flaw might be abused by sending a maliciously crafted picture to a sufferer’s telephone, possible delivered by way of a messaging app, and that the assaults could not have required any interplay from the sufferer.

Samsung patched the safety flaw — tracked as CVE-2025-21042 — in April 2025, however particulars of the spyware and adware marketing campaign abusing the flaw haven't been beforehand reported.

The researchers stated in a weblog submit that it’s not identified which surveillance vendor developed the Landfall spyware and adware, neither is it identified what number of people had been focused as a part of the marketing campaign. However the researchers stated that the assaults possible focused people within the Center East.

Itay Cohen, a senior principal researcher at Unit 42, informed TechCrunch that the hacking marketing campaign consisted of a “precision assault” on particular people and never a mass-distributed malware, which signifies that the assaults had been possible pushed by espionage.

Unit 42 discovered that the Landfall spyware and adware shares overlapping digital infrastructure utilized by a identified surveillance vendor dubbed Stealth Falcon, which has been beforehand seen in spyware and adware assaults in opposition to Emirati journalists, activists, and dissidents way back to 2012. However the researchers stated that the hyperlinks with Stealth Falcon, whereas intriguing, weren't sufficient to obviously attribute the assaults to a selected authorities buyer.

Unit 42 stated that the Landfall spyware and adware samples that they found had been uploaded to VirusTotal, a malware scanning service, from people in Morocco, Iran, Iraq, and Turkey all through 2024 and early 2025.

Turkey’s nationwide cyber readiness crew, referred to as USOM, flagged one of many IP addresses that the Landfall spyware and adware related to as malicious, which Unit 42 stated helps the idea that people in Turkey could have been focused.

Very similar to different authorities spyware and adware, Landfall is able to broad system surveillance, reminiscent of accessing the sufferer’s knowledge, together with images, messages, contacts and name logs, in addition to the tapping of the system’s microphone and monitoring their exact location.

Unit 42 discovered that the spyware and adware’s supply code referenced 5 particular Galaxy telephones, together with the Galaxy S22, S23, S24, and a few Z fashions, as targets. Cohen stated that the vulnerability could have additionally been current on different Galaxy units, and affected Android variations 13 by way of 15.