---
title: "'Landfall' Spyware Exploited Samsung Galaxy Phones in Middle East for Months"
description: "\"Landfall\" spyware secretly targeted Samsung Galaxy users, exploiting a zero-day via WhatsApp, evading detection and raising surveillance concerns."
canonical_url: https://codekeeper.co/ticker/landfall-spyware-targets-samsung-galaxy-users
---

# 'Landfall' Spyware Exploited Samsung Galaxy Phones in Middle East for Months

"Landfall" spyware secretly targeted Samsung Galaxy users, exploiting a zero-day via WhatsApp, evading detection and raising surveillance concerns.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 8, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Security researchers discovered sophisticated spyware called "Landfall" that secretly targeted Samsung Galaxy users across Iraq, Iran, Turkey, and Morocco from mid-2024 through April 2025. The malware exploited a critical zero-day vulnerability in Samsung's image processing library, delivered through weaponized image files sent via WhatsApp. Landfall could record conversations, track locations, capture photos, and steal contacts from high-end Galaxy devices like the S22, S23, and S24 series. Palo Alto Networks' Unit 42 team found the spyware had advanced detection evasion capabilities and linked it to commercial-grade surveillance operations similar to NSO Group's Pegasus. Samsung patched the vulnerability after researchers privately reported it, but the campaign highlights how commercial spyware vendors increasingly target mobile platforms for government surveillance. **Source:** [Dark Reading](https://www.darkreading.com/mobile-security/landfall-malware-targeted-samsung-galaxy-users)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flandfall-spyware-targets-samsung-galaxy-users%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data Breach Hits 3 Million Texas Hunting and Fishing License Holders Aug 12, 2026](https://codekeeper.co/ticker/texas-credit-monitoring-after-data-breach)

[Software security Leader of 15 000-Mule Laundering Network Pleads Guilty Oct 13, 2026](https://codekeeper.co/ticker/oleg-korniev-guilty-money-laundering-ymco)

[Windows Netlogon RCE Reported Under Active Exploitation — Patch Now Aug 12, 2026](https://codekeeper.co/ticker/critical-netlogon-vulnerability-patch-immediately)

[Ransomware Gang Teams Up With Supply Chain Hackers in "Industrialized" Attack Model Aug 12, 2026](https://codekeeper.co/ticker/sophos-warns-of-vect-teampcp-cyber-threat)