Story perspectives

Spyware Landfall Targets Samsung Phones in Middle East

11/8/2025

49 6

Summary

Story summary

Palo Alto Networks’ Unit 42 identified Landfall, a spyware targeting Samsung Galaxy phones in the Middle East.
Landfall exploits CVE-2025-21042, a zero-day patched by Samsung in April 2025.
The campaign began July 2024, targeting people in Iran, Iraq, Morocco, and Turkey via malicious DNG image files sent through WhatsApp.
Landfall can access microphone recordings and location.
There are similarities between Landfall's infrastructure and Stealth Falcon, and Samsung has not commented.

1 of 1

Story summary

Palo Alto Networks’ Unit 42 identified Landfall, a spyware targeting Samsung Galaxy phones in the Middle East.
Landfall exploits CVE-2025-21042, a zero-day patched by Samsung in April 2025.
The campaign began July 2024, targeting people in Iran, Iraq, Morocco, and Turkey via malicious DNG image files sent through WhatsApp.
Landfall can access microphone recordings and location.
There are similarities between Landfall's infrastructure and Stealth Falcon, and Samsung has not commented.