Samsung Galaxy’s Spyware Drama: LANDFALL Exploit Hits Middle East Before Patch
Samsung Galaxy devices fell victim to LANDFALL, a sneaky spyware exploiting a zero-day flaw. While Samsung has patched this out-of-bounds write flaw, the bug had Middle Eastern phones singing like canaries, sharing data without consent. Palo Alto Networks Unit 42 cracked the case, proving once again that sometimes, bugs are more than just a nuisance.
Hot Take:
Samsung’s Galaxy phones just got a little too hot to handle! Turns out, their “libimagecodec.quram.so” had more holes than Swiss cheese, and cybercriminals in the Middle East couldn’t resist a taste. Luckily, Samsung patched it up in April 2025, but not before some sneaky cyber spies had their fun. Maybe it’s time for Samsung to consider a new slogan: “Do What You Can’t… Except for Security Flaws!”
Key Points:
- Samsung patched a zero-day flaw in Galaxy devices after it was exploited in the Middle East.
- The flaw, CVE-2025-21042, was in the “libimagecodec.quram.so” component, with a CVSS score of 8.8.
- The LANDFALL spyware was used to harvest sensitive data via malicious DNG image files.
- Similar flaws were exploited in WhatsApp and Apple devices but are now patched.
- The origins of the spyware remain unknown, but it’s suspected to be linked to Stealth Falcon.