Landfall Spyware Targets Samsung Galaxy Phones

Security researchers at Palo Alto Networks’ Unit 42 discovered an Android spyware called Landfall, which exploited a zero-day vulnerability in Samsung Galaxy phones. The spyware, first detected in July 2024, relied on a security flaw patched in April 2025. The attacks likely targeted individuals in a specific region and were delivered through maliciously crafted images, possibly via WhatsApp. The spyware shares overlapping digital infrastructure with a known surveillance vendor, Stealth Falcon. Landfall is capable of broad device surveillance, including accessing photos, messages, contacts, call logs, and tracking location. The spyware's source code referenced five specific Galaxy phone models as targets.