A newly discovered Android spyware, dubbed LANDFALL, has been targeting Samsung Galaxy devices in the Middle East, with Morocco identified as a potential victim, according to a report released Thursday by Unit 42, the cybersecurity research team at Palo Alto Networks.
The malware spreads via malicious image files mimicking WhatsApp-style filenames, suggesting attackers attempted to exploit users through messaging apps. First samples of LANDFALL appeared in July 2024 and remained active and undetected for months.
Designed for stealth, persistence, and data theft, the spyware can collect sensitive information from infected devices.
It exploited a Samsung vulnerability that was actively targeted in the wild before being patched in April 2025.
Samsung later patched another related vulnerability in September 2025, providing further protection.
Citing VirusTotal data, the Unit 42 report identified potential victims not only in Morocco but also in Iraq, Iran, and Turkey.
The discovery comes amid a rising wave of cyber threats affecting Morocco. Earlier research by cybersecurity firm Cleafy revealed that a Chinese-speaking hacker group developed PlayPraetor, which infected more than 11,000 Android devices worldwide in under three months.
Morocco was the most targeted country in Africa, accounting for roughly 22% of attacks on the continent.
Both malware families are capable of stealing sensitive data, taking control of devices, and enabling on-device fraud, highlighting the growing risks facing Moroccan smartphone users.
Cybersecurity experts urge users to keep devices updated with the latest security patches and to exercise caution when opening files from unknown sources.
add your comment
Terms of publication : Not to offend the writer, people, sacred things, or attack religions or the divine self, and refrain from racist incitement and insults.