‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones

Palo Alto Networks' Unit 42 discovered "Landfall" spyware that exploited a zero-day vulnerability in Samsung Galaxy phones for nearly a year, enabling extensive surveillance on individuals, primarily in the Middle East. This sophisticated campaign, potentially linked to state-sponsored espionage and affecting Galaxy S22, S23, S24, and Z models, underscores the persistent and advanced cybersecurity risks to critical mobile infrastructure and the heightened data security challenges for high-value targets.

Analysis

Palo Alto Networks' Unit 42 uncovered "Landfall" spyware, which exploited a zero-day vulnerability (CVE-2025-21042) in Samsung Galaxy phones for nearly a year, from July 2024 until Samsung issued a patch in April 2025. This sophisticated attack, potentially delivered via a malicious image without victim interaction, targeted specific Galaxy models including the S22, S23, S24, and Z series, affecting Android versions 13 through 15.

The campaign is characterized as a "precision attack" driven by espionage, primarily targeting individuals in the Middle East, with samples uploaded from Morocco, Iran, Iraq, and Turkey. Landfall exhibits broad surveillance capabilities, accessing photos, messages, contacts, call logs, and enabling microphone tapping and location tracking. While sharing infrastructure with the known vendor Stealth Falcon, direct government attribution remains unconfirmed.

This incident highlights persistent advanced persistent threat (APT) risks to mobile infrastructure and the critical need for robust cybersecurity solutions. Samsung's non-response and the year-long zero-day exploitation could raise concerns regarding device security and brand trust. For Palo Alto Networks (PANW), the discovery reinforces its expertise in threat intelligence, contributing to its positive sentiment.

Key Decisions for Investors

• Investors should monitor Samsung's future security disclosures and potential impacts on consumer trust and device sales, especially given the lack of comment on this significant zero-day exploitation.
• Consider increased investment in cybersecurity firms specializing in advanced threat detection and mobile security, as the "Landfall" discovery underscores the growing sophistication of state-sponsored espionage and zero-day attacks, potentially benefiting companies like Palo Alto Networks (PANW).
• Evaluate the broader implications for mobile device manufacturers and software providers, as this incident highlights the critical need for proactive vulnerability management and rapid patching cycles to mitigate high-impact, precision-targeted threats.