A chilling reminder that sometimes, you don’t even have to click anything to get hacked.
Cybersecurity researchers at Palo Alto Networks’ Unit 42 have uncovered a stealthy spyware campaign called “Landfall” that silently targeted Samsung Galaxy phones for months.
What makes this attack so alarming is its simplicity. Hackers used infected images sent via WhatsApp to compromise devices. Victims didn’t have to tap, install, or even open anything. The attack triggered the moment the malicious image arrived.
This zero-click exploit took advantage of a Samsung software vulnerability (CVE-2025-21042) in the company’s image-processing library, turning the ordinary act of receiving a picture into a gateway for full-scale surveillance.
How the Hack Worked
Attackers disguised Digital Negative (DNG) files, a professional photo format, as everyday JPEGs. When a vulnerable Samsung device processed one of these images (for example, through WhatsApp’s media preview), the embedded malware executed automatically.
Once active, Landfall behaved like a professional-grade spy tool capable of:
- Reading private messages and photos
- Listening to calls and ambient audio
- Accessing contacts and files
- Tracking real-time location data
Essentially, the spyware granted hackers complete control of the device without any user interaction.
Who Was Targeted
The campaign primarily affected recent flagship models, including:
- Samsung Galaxy S22, S23, and S24
- Z Fold 4 and Z Flip 4
Most infections were detected across the Middle East, including Turkey, Iran, Iraq, and Morocco.
The operation began in mid-2024 and ran undetected for several months, until researchers found traces of infected files uploaded to Google’s VirusTotal database.
Samsung reportedly received a warning in September 2024 and released a security patch only in April 2025, leaving millions of users potentially exposed for almost half a year.
Possible Links to Espionage
While the exact perpetrators remain unknown, Unit 42 noted that Landfall’s digital signatures closely resembled past attacks by Stealth Falcon, a surveillance group previously tied to state-sponsored espionage against journalists and activists in the UAE.
Experts believe this was a targeted espionage operation, not a mass attack or financial scam. One of the spyware’s command servers was even flagged by Turkey’s national cyber agency, confirming that regional users were indeed affected.
Why It Matters?
This incident is not just about Samsung or WhatsApp; it’s a wake-up call for every smartphone user.
It shows how cybercriminals are evolving beyond phishing links and fake apps. Even zero-click exploits, once limited to nation-state operations, are now being used in commercial spyware campaigns.
Your phone’s camera, microphone, GPS, and storage can all become surveillance tools in the wrong hands and you might never notice.
How to Protect Yourself?
Here are five essential cybersecurity habits that can make a real difference:
- Keep your phone updated: Always install security updates as soon as they’re released. They’re not optional; they’re your first defense.
- Be cautious with media files: Avoid forwarding or saving images from unknown or untrusted sources, even from known contacts, if something feels off.
- Enable automatic updates for apps: Messaging apps like WhatsApp regularly patch security holes. Keep them current.
- Use built-in or third-party mobile protection tools: Reputable security apps can help detect unusual behavior or unauthorized access.
- Review app permissions regularly: Check which apps can access your camera, mic, and storage. Revoke unnecessary privileges.
Final Thoughts
The Landfall spyware attack is a stark reminder that cybersecurity is no longer just about avoiding suspicious links; it’s about awareness and hygiene in everyday digital behavior.
Even a simple image can carry a silent threat. Staying informed, vigilant, and updated is the only way to keep your personal data and your privacy truly safe.
Because in today’s world, you don’t have to click to get hacked.
