These Galaxy phones were attacked by spyware for nearly a year before a patch was released

Samsung Galaxy phones were compromised for nearly a year by "LANDFALL" spyware, exploiting a zero-day vulnerability (CVE-2025-21042) in the company's image processing library. This allowed attackers to record audio, track location, and access personal data on models including the S22, S23, S24, and Z Fold/Flip 4, primarily in targeted espionage attacks. Although Samsung patched the flaw in April, it made no public statement until recently, highlighting ongoing cybersecurity risks for major technology firms and potential reputational implications from delayed disclosure of critical vulnerabilities.

Analysis

The article details a significant cybersecurity breach affecting Samsung Galaxy phones, where a zero-day vulnerability (CVE-2025-21042) in Samsung's Android image processing library allowed "LANDFALL" spyware to compromise devices for approximately ten months, from July 2024 until a patch in April 2025. This spyware, delivered via malicious DNG image files, enabled extensive surveillance capabilities including microphone recording, location tracking, and access to sensitive personal data on models such as the Galaxy S22, S23, S24, and Z Fold/Flip 4. The attacks were highly targeted, primarily for espionage purposes in the Middle East.

Samsung's delayed public disclosure of this critical vulnerability, despite patching it in April 2025, raises concerns regarding transparency and user security, contributing to a "moderately negative" sentiment. Palo Alto Network's Unit 42 identified LANDFALL's operations, highlighting the crucial role of independent cybersecurity firms in uncovering such threats, which aligns with PANW's positive per-ticker sentiment. Meta, owner of WhatsApp, has denied any basis for claims regarding its platform's involvement in delivering the exploit.

This incident, coupled with a second zero-day (CVE-2025-21043) patched in September within the same library, underscores persistent cybersecurity risks for major technology companies. The "cautious" tone reflects potential reputational damage for device manufacturers and increased scrutiny on software security practices, reinforcing the value proposition of advanced cybersecurity solutions and services.

Key Decisions for Investors

• Investors should evaluate cybersecurity firms, particularly those specializing in threat intelligence and endpoint protection like Palo Alto Networks (PANW), for potential growth opportunities given the increasing sophistication and prevalence of zero-day exploits.
• Institutional investors with holdings in device manufacturers should scrutinize companies' cybersecurity disclosure policies, patch management timelines, and overall security investments, as delayed transparency can lead to reputational and regulatory risks.
• Consider the broader implications for the Android ecosystem and the supply chain, as vulnerabilities in core components or libraries can have widespread impact, prompting a review of security standards across hardware and software providers.