{"id":224725,"date":"2025-11-08T00:12:15","date_gmt":"2025-11-08T06:12:15","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2025\/11\/samsung-mobile-flaw-exploited-as-zero-day-to-deploy-landfall-android-spyware"},"modified":"2025-11-08T00:12:15","modified_gmt":"2025-11-08T06:12:15","slug":"samsung-mobile-flaw-exploited-as-zero-day-to-deploy-landfall-android-spyware","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2025\/11\/samsung-mobile-flaw-exploited-as-zero-day-to-deploy-landfall-android-spyware","title":{"rendered":"Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/samsung-mobile-flaw-exploited-as-zero-day-to-deploy-landfall-android-spyware.jpg\"><\/a><\/p>\n<p>It\u2019s assessed that the attacks involved sending via WhatsApp malicious images in the form of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Digital_Negative\">DNG<\/a> (Digital Negative) files, with evidence of LANDFALL samples going all the way back to July 23, 2024. This is based on DNG artifacts bearing names like \u201cWhatsApp Image 2025\/02\/10 at 4.54.17 PM.jpeg\u201d and \u201cIMG-20240723-WA0000.jpg.\u201d<\/p>\n<p>Itay Cohen, senior principal researcher at Palo Alto Networks Unit 42, told The Hacker News that they have not observed any significant functional changes between the samples from July 2024 and February 2025, when the most recent LANDFALL artifact was uploaded to VirusTotal.<\/p>\n<p>LANDFALL, once installed and executed, acts as a comprehensive spy tool, capable of harvesting sensitive data, including microphone recording, location, photos, contacts, SMS, files, and call logs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It\u2019s assessed that the attacks involved sending via WhatsApp malicious images in the form of DNG (Digital Negative) files, with evidence of LANDFALL samples going all the way back to July 23, 2024. This is based on DNG artifacts bearing names like \u201cWhatsApp Image 2025\/02\/10 at 4.54.17 PM.jpeg\u201d and \u201cIMG-20240723-WA0000.jpg.\u201d Itay Cohen, senior principal researcher [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1512],"tags":[],"class_list":["post-224725","post","type-post","status-publish","format-standard","hentry","category-mobile-phones"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/224725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=224725"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/224725\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=224725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=224725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=224725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}