If you use a Samsung Galaxy phone, you should be aware of a new security threat that may have put your personal data at risk. Researchers have discovered a new spyware called LANDFALL, which secretly targeted Galaxy phones using a hidden flaw in the system. According to global cybersecurity company Palo Alto Networks’ Unit 42 division, this newly discovered spyware took advantage of a zero-day vulnerability. The flaw was found in Samsung’s Android image processing library.
Survey
✅ Thank you for completing the survey!
The attack method was surprisingly simple but effective. Hackers sent malicious image files (in DNG format) through popular messaging apps like WhatsApp. When a Galaxy phone tried to open or process one of these images, the spyware automatically installed itself without any action from the user.
Once inside, LANDFALL could secretly gather sensitive information such as photos, contacts, call logs, microphone recordings, and location data. It also had tools to hide itself, making it difficult to detect or remove.
Researchers believe the spyware was used during 2024 and early 2025, mostly in Middle Eastern regions. The affected Samsung devices include those running One UI 5 to One UI 7 (Android 13 to Android 15), such as the Galaxy S22, Galaxy S23, Galaxy S24, and foldable models like the Galaxy Z Fold 4 and Z Flip 4.
Samsung fixed the issue in April 2025 through a software update, reports Android Authority. This attack proves that no smartphone is completely safe from cyber threats. Staying alert and keeping your phone updated are the best ways to protect your data.
Ayushi works as Chief Copy Editor at Digit, covering everything from breaking tech news to in-depth smartphone reviews. Prior to Digit, she was part of the editorial team at IANS. View Full Profile