NEW LANDFALL SPYWARE EXPLOITED SAMSUNG ZERO-DAY VIA WHATSAPP MESSAGES

Summary from the TLDR InfoSec newsletter

A threat actor exploited CVE-2025-21042, a critical out-of-bounds write zero-day in Samsung's libimagecodec.quram.so library, to deploy LandFall spyware via malicious .DNG images sent through WhatsApp to Samsung Galaxy users (S22, S23, S24, Z Fold 4, and Z Flip 4) in the Middle East from July 2024 until Samsung patched it in April 2025. The spyware delivered a malformed DNG file with an embedded ZIP archive containing a loader and SELinux policy manipulator, enabling extensive spying such as microphone/call recording, location tracking, and access to photos, contacts, SMS, call logs, files, and browsing history while maintaining persistence and evading detection. Security professionals should ensure devices are updated with April 2025 patches, disable automatic media downloads, enable Android's Advanced Protection or iOS Lockdown Mode for high-risk users, and monitor for similar DNG exploitation patterns, given recent trends of commercial spyware leveraging image vulnerabilities.