Cybersecurity firm Unit 42 has discovered a spyware campaign on Samsung Galaxy devices exploiting a zero-day vulnerability to infiltrate phones through images sent via WhatsApp. The operation has been coined by the cybersecurity researchers as LANDFALL, detected in September after an investigation that began probing iOS exploit samples in mid-2025. The vulnerability was patched in April 2025 following reports of active exploitation, but not before it had malformed DNG files containing an appended ZIP archive on several devices. Unit 42 explained that it tricks the vulnerable library into extracting and executing shared object (.so) libraries that installed the spyware on devices. The zero-day flaw is also affecting DNG image parsing on Apple iOS, where WhatsApp devs discovered attackers were chaining the Apple vulnerability with the flaw to force devices to process content from malicious URLs. Which is the most secure phone in the world ?

