Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Samsung fixed the image-processing flaw linked to LANDFALL spyware in an April 2025 security update. Palo Alto Networks Unit 42 later reported that attackers had exploited it before the patch, using malicious DNG image files. The report does not establish exactly how the files reached targets, how many people were affected, or that every Galaxy model named in the malware was compromised.
What happened
LANDFALL is Android spyware that Unit 42 found embedded in malicious Digital Negative (DNG) image samples. The researchers linked those files to CVE-2025-21042, an out-of-bounds write flaw in Samsung’s Android image-processing library. The flaw could be exploited by a specially crafted image to deliver malware, according to Unit 42’s November 7, 2025 report.
The exploit was a zero-day in the historical sense: the campaign was active before Samsung issued a fix. It should not be described as an unpatched current threat. Samsung’s April 2025 firmware update addressed the vulnerability, which was previously tracked as SVE-2024-1969.
LANDFALL timeline
- July 2024: The earliest LANDFALL DNG samples identified by Unit 42 appeared in VirusTotal.
- September 25, 2024: Unit 42 says it privately notified Samsung about the flaw.
- April 2025: Samsung issued a firmware update addressing the vulnerability.
- Mid-2025: During an investigation of a separate iOS exploit chain, Unit 42 found the Android DNG samples.
- November 7, 2025: Unit 42 published its analysis of LANDFALL.
How the image exploit may have reached phones
Unit 42 found that the DNG files contained an image component and embedded malware components. The report says the samples appeared to be sent through WhatsApp and that zero-click delivery was possible. That is a proposed delivery scenario, not a confirmed reconstruction of how a target received or opened a file.
#1 Best Overall
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Unit 42 explicitly said, “Our research did not identify any unknown vulnerabilities in WhatsApp.” The finding concerns a flaw in Samsung’s image-processing library; it does not establish that WhatsApp itself had a vulnerability in this campaign.
What LANDFALL could access
The analyzed files included a “Bridge Head” loader and evidence of a larger, staged framework. Unit 42’s report describes command strings and execution paths that suggest potential capabilities such as device fingerprinting, location access, microphone and call recording, and collection of contacts, messages, photos, files, and databases. It also describes possible persistence, process injection, SELinux policy manipulation, and anti-analysis measures.
Rank #2
- Please note, this device does not support E-SIM; This 4G model is compatible with all GSM networks worldwide outside of the U.S. In the US, ONLY compatible with T-Mobile and their MVNO's (Metro and Standup). It will NOT work with other CDMA carriers, and it is also not compatible with their MVNO (Visible, Xfinity Mobile, US Mobile, Cricket Wireless, etc).
- Compatibility with certain third-party devices and accessibility accessories, including some hearing aids, may vary depending on manufacturer support, Bluetooth protocols, software compatibility, and regional firmware limitations. For additional hearing aid compatibility information, please refer to Samsung’s official support documentation.
- Camera: 50 MP, f/1.8, (wide), 1/2.76", 0.64µm, AF | 50 MP, f/1.8, (wide), 1/2.76", 0.64µm, AF | 2 MP, f/2.4, (macro). Battery: 5000 mAh, non-removable | A power adapter is NOT included.
These are indications of potential framework capabilities, not proof that every function ran on every target. Unit 42 had not directly analyzed the next-stage components that could implement many of them.
Which Samsung models were named?
Model and build strings in the analyzed samples included the Galaxy S22, S23 series, S24 series, Galaxy Z Fold4, and Galaxy Z Flip4. These strings indicate targeting intent in the samples; they are not a complete list of vulnerable devices, nor evidence that every phone in those families was infected.
Recommended Free Tools
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Was your Samsung phone affected?
The published report does not provide a victim count or a way to determine whether a particular person was targeted. A model name in a sample cannot answer that question. For your phone’s patch status, check the installed security software version and compare it with Samsung’s Security Maintenance Release bulletin. Samsung updates the bulletin monthly, and supported models and rollout timing can vary by device, carrier, and region.
- Open Settings on your Samsung phone.
- Tap About phone, then Software information.
- Find Android security patch level and note its date.
- Check Samsung’s current Security Maintenance Release bulletin for your device’s model and update information. A listed release does not by itself confirm that the update is installed on your phone.
If you suspect targeted compromise, Unit 42 points potentially affected readers to its incident-response team. This is a professional-response resource, not a guarantee that an infection can be confirmed or remediated.
Quick Recap
Best Value
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist¹ with Galaxy AI.² Add objects, restore details, or apply new styles by simply typing or tapping
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile whether it’s a special contact photo, custom wallpaper, an invitation or more³
- FAST. POWERFUL. AI-READY: Power through your day with AI-accelerated performance from our fastest, smoothest and most powerful Galaxy processor yet, built to keep up with everything you do
- IMMENSELY IMMERSIVE: No matter where you are or what you’re watching, your favorite videos and more come to life with the vibrant display on Galaxy S26
- FIT EVERYONE IN THE SHOT: Group selfies are easier on your Samsung phone with a wider front camera⁴ that captures more of the scene, so no one gets left out of the moment
Rank #4
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
What remains unknown
- The exact delivery route and whether any target needed to interact with the image.
- The total number of victims; Unit 42 published no population estimate.
- Whether all of the framework’s indicated capabilities were implemented or used in a particular case.
- The identity of the operator. Unit 42 noted similarities to commercial spyware activity but did not officially attribute LANDFALL to a known actor.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
