LANDFALL Spyware Exploitation via LD_PRELOAD

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•3

Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.