Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Landfall spyware targeting Samsung Galaxy phones

Malware Activity
First reported
Last updated
Happening score
H score 16
2 unique sources, 2 articles

Summary

Hide ▲

Landfall is an Android spyware operation that used CVE-2025-21042 in a Samsung image processing library to compromise Samsung Galaxy phones and enable surveillance plus data theft. The activity matters because the spyware could record microphone audio, track location, and steal photos, contacts, and call logs from infected devices. Evidence indicates the attacks were active since at least July 2024 and likely used a zero-click delivery path through WhatsApp. A later CISA alert also tied LANDFALL to a targeted campaign that exploited Samsung CVE-2025-21042 to deliver Android spyware to Galaxy devices in the Middle East.

Related Happenings

AirDrop and Quick Share fixes from Apple and Google

Security Patch Release
H score27 First: 30.06.2026 12:27 Last: 30.06.2026 12:27 Sources 1

About this happening: Apple and Google have started shipping fixes for the disclosed AirDrop and Quick Share flaws, reducing exposure for nearby attacks against widely used sharing feat...

Open Happening

AirDrop and Quick Share nearby crash and session-bypass flaws security flaw

Vulnerability
H score1 First: 30.06.2026 12:27 Last: 30.06.2026 12:27 Sources 1

About this happening: Nearby attackers can crash AirDrop and bypass Quick Share session checks, exposing Apple, Samsung, and Google Windows file-sharing stacks to local disruption a...

Open Happening

WhatsApp contempt motion against NSO Group

Regulatory/Legal Action
H score33 First: 09.06.2026 11:15 Last: 09.06.2026 11:15 Sources 1

About this happening: WhatsApp moved the US court to hold NSO Group in contempt over a permanent injunction tied to spyware targeting of users. The company says NSO violated the order by us...

Open Happening

NSO Group WhatsApp spear-phishing campaign

Campaign
H score37 First: 08.06.2026 20:08 Last: 08.06.2026 20:08 Sources 1

About this happening: NSO Group remains tied to a WhatsApp spear-phishing campaign that used malicious links to push targets to external websites outside the app. On June 8, WhatsAp...

Open Happening

AI-driven attack surge against customer-facing mobile apps in 2026

Trend
H score43 First: 19.05.2026 15:00 Last: 19.05.2026 15:00 Sources 1

About this happening: Customer-facing mobile apps faced a sharp rise in attacks in 2026, with 87% of monitored apps hit versus 55% in 2022. The trend matters because agentic AI is l...

Open Happening

Timeline

  1. 07.11.2025 17:29 3 articles · 8mo ago

    Landfall spyware targeting Samsung Galaxy phones

    Initial Disclosure

    The first observed phase was the zero-day delivery of Landfall to Samsung Galaxy users through a specially crafted DNG image sent over WhatsApp. That initial compromise path enabled code execution through CVE-2025-21042 and set up device surveillance.

    Show sources
    Open in new tab