A newly discovered spyware campaign, dubbed LANDFALL, has been targeting Samsung Galaxy users in Morocco and beyond, exploiting a zero-day vulnerability in WhatsApp's image-sharing feature to infiltrate devices without user interaction. Uncovered by Palo Alto Networks' Unit 42, this advanced malware has been active since mid-2024, allowing attackers to conduct extensive surveillance before Samsung's recent patch in 2025. Cybersecurity researchers have uncovered a sophisticated digital espionage campaign targeting Samsung phone users in several countries, including Morocco, through a newly identified spyware dubbed LANDFALL. The malware was specifically designed to infiltrate Samsung Galaxy devices without any user interaction, exploiting WhatsApp's image-sharing feature. Images Carrying Spyware, No Clicks Required According to a report published two days ago by Unit 42, the threat intelligence team at Palo Alto Networks, attackers exploited a serious zero-day vulnerability in Samsung's image-processing library, tracked as CVE-2025-21042. The flaw allowed them to embed spyware inside DNG image files and send them via WhatsApp, where the infection occurred automatically, without victims opening or clicking on the image. Once installed, LANDFALL enabled extensive surveillance, including recording audio through the microphone, tracking GPS location, and accessing photos, contacts, and call logs. Researchers noted the spyware's advanced design, built for stealth, persistence, and large-scale data collection across modern Samsung devices. Exploited for Months Before Samsung's Patch Evidence suggests the campaign had been active since mid-2024, months before Samsung patched the flaw in April 2025. Malicious samples were also uploaded to VirusTotal from countries such as Iraq, Iran, Turkey, and Morocco, indicating that users in these regions were among the primary targets. Unit 42 linked the campaign's infrastructure to known private-sector offensive actors (PSOAs) operating in the Middle East, noting its resemblance to an August 2025 iPhone attack that used a nearly identical WhatsApp image exploit. Samsung has since neutralized the threat by fixing both CVE-2025-21042 and a related bug, CVE-2025-21043, in a September 2025 update. Still, researchers described LANDFALL as «one of the most sophisticated and elusive espionage tools uncovered before public disclosure».
