Hackers used booby-trapped images to spy on Samsung phones, no clicks required

Palo Alto Networks Unit 42 uncovered "Landfall," a sophisticated commercial-grade spyware that exploited a zero-day vulnerability (CVE-2025-21042) in Samsung's Android software, enabling zero-click surveillance on Galaxy S22-S24 and foldable devices throughout 2024 and early 2025. This advanced malware, likely developed by commercial surveillance contractors, allowed remote access to sensitive user data and device functions, targeting specific regions in the Middle East. While Samsung issued a patch in April 2025, the spyware's system-level modifications make removal difficult, underscoring the escalating threat of highly advanced mobile espionage and the challenges in mitigating such sophisticated attacks even post-patch.

Analysis

Palo Alto Networks Unit 42 has uncovered "Landfall," a sophisticated commercial-grade spyware exploiting a zero-day vulnerability (CVE-2025-21042) in Samsung's Android software. This zero-click exploit, active throughout most of 2024 and early 2025, allowed attackers to gain extensive access to sensitive data and device functions on targeted Samsung Galaxy S22-S24 and foldable models. The campaign, focused on specific regions in the Middle East, highlights the evolving threat landscape of mobile espionage.

The malware leveraged manipulated DNG image files to embed malicious payloads, exploiting flaws in Samsung's image processing component without user interaction. While Samsung issued a patch in April 2025 for Android versions 13-15, Landfall's ability to modify system-level configurations makes its removal challenging even post-patch. This indicates a persistent risk for affected devices and underscores the difficulty in fully remediating advanced threats.

Unit 42's analysis suggests the spyware exhibits coding styles and infrastructure consistent with established commercial surveillance contractors, similar to NSO Group or Variston, rather than a one-off criminal toolset. This points to a well-resourced, professional development team behind the attacks. The incident reinforces the critical need for robust cybersecurity measures and continuous vigilance against state-sponsored or commercially developed advanced persistent threats (APTs) in the mobile sector.

Key Decisions for Investors

• For Samsung investors, monitor future security disclosures and potential reputational impacts, as sophisticated vulnerabilities could affect consumer trust and market share in the competitive mobile device sector.
• For cybersecurity sector investors, particularly those with exposure to Palo Alto Networks (PANW), evaluate increased demand for advanced threat intelligence, mobile security solutions, and incident response services, as this incident underscores the growing sophistication of mobile exploits.
• Institutional investors with exposure to technology and telecom should assess the broader implications of zero-click exploits on device security roadmaps and R&D spending across the mobile ecosystem, considering potential regulatory scrutiny and liability.