The malware, named LANDFALL, was found to be exploiting a zero-day vulnerability in Samsung’s Android image processing library.

According to Unit 42, attackers used the flaw — tracked as CVE-2025-21042 — to embed the spyware within malicious DNG image files, which were allegedly delivered via WhatsApp. Opening the infected image allowed the malware to execute on the device.

The research team noted that the vulnerability was actively exploited in the wild before Samsung released a security patch in April 2025. Details on the full capabilities of LANDFALL and the exploit toolkit used have not yet been made public.

Cybersecurity experts have advised Samsung Galaxy users to ensure their devices are updated with the latest firmware and security patches to reduce exposure to the threat.