Welcome to Jean-Claude Moritz' Website, your source for everything. Tech, Blogs, etc.
The more we can automate cybersecurity, the more we can eliminate future attacks before they cause a lot of harm.
Satya Nadella
Cyber Events
Samsung Zero-Day Vulnerability: What You Need to Know
A newly discovered Samsung zero-day vulnerability (CVE-2025-21042) allowed attackers to take control of Galaxy devices without user interaction. This flaw was exploited in the wild by spyware known as LANDFALL, which targeted flagship Samsung phones throughout 2024 and early 2025 before being patched in April 2025.
What Happened?
- The vulnerability existed in Samsung’s image processing library (libimagecodec.quram.so).
- Attackers weaponized malicious DNG image files sent via messaging apps like WhatsApp.
- The exploit was zero-click: victims didn’t need to open or interact with the file—simply receiving it triggered the compromise.
Impact
- Once infected, LANDFALL spyware could:
- Record microphone audio
- Track location
- Steal photos, contacts, call logs, SMS, and files
- Evade detection and persist for months
- Targeted devices included Galaxy S22, S23, S24, Z Fold 4, and Z Flip 4 models running Android 13–15 (One UI 5–7).
- Most attacks were reported in the Middle East and North Africa, but the risk was global.
Why It Matters
This case highlights the growing trend of zero-click exploits—attacks that don’t rely on user mistakes. For businesses and individuals, it underscores the importance of:
- Regular security updates: Samsung patched CVE-2025-21042 in April 2025, but many devices remained exposed for months.
- Awareness of spyware threats: LANDFALL resembles tools used by commercial surveillance vendors, raising concerns about privacy and espionage.
What You Should Do
- Update immediately: Ensure your Samsung device is running the latest firmware and security patch.
- Stay alert: Even innocuous-looking files can be weaponized.
- Follow official advisories: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-21042 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by December 1, 2025.
Final Thoughts
While Samsung has addressed the flaw, the LANDFALL campaign is a reminder that mobile devices are prime targets for advanced spyware. Keeping your phone updated isn’t just about new features—it’s about defending against silent, invisible attacks that can compromise your privacy and security.
Sources: Android Authority, BleepingComputer, SecurityWeek, The Hacker News, HotHardware, Malwarebytes
Meta rolls out Scam Protection
The Fake PayPal Invoice from “Geek Squad” Scam
If you’ve received a PayPal invoice that looks like it’s from Geek Squad or Best Buy, don’t panic—and don’t call the number. This scam has been circulating for months, and it’s catching people off guard with official-looking emails and urgent language.
📬 How the Scam Works
- You get an email from PayPal with an invoice attached, supposedly from Geek Squad.
- The invoice claims you’re being charged $359.99 (or similar) for a “security services” subscription.
- It includes a phone number to call if you want to cancel or dispute the charge.
- When you call, a fake “customer service agent” tries to:
- Get access to your bank account
- Convince you to install remote support software
- Trick you into refunding money that never left your account
🧠 Why It’s Convincing
- The invoice often comes from legitimate invoicing platforms like PayPal, QuickBooks, or Housecall Pro.
- It uses real logos and corporate-style formatting.
- The scammers use urgency and fear to push you into acting fast.
🔐 What to Do If You Get One
- Do not call the number listed in the invoice.
- Do not click any links or download attachments.
- Log into PayPal directly (not through the email) and check your activity.
- Report the invoice as fraudulent through PayPal’s resolution center.
- Forward the email to phishing@paypal.com to help others avoid it.
✅ How to Stay Safe
- Keep track of your subscriptions—if you don’t use Geek Squad, it’s likely fake.
- Know how real invoices look and how companies contact you.
- Use antivirus software and browser extensions that block phishing attempts.
- Educate friends and family—especially those less tech-savvy.
Meta rolls out Scam Protection
Meta rolls out Scam Protection
Meta has rolled out new scam protection tools for WhatsApp and Messenger to help users—especially older adults—stay safe from fraud and manipulation. These updates include AI-powered scam detection, screen-sharing alerts, and stronger account security options.
Meta’s latest safety push targets the growing wave of scams across messaging platforms. On WhatsApp, users now receive alerts when they attempt to share their screen during video calls with unknown contacts—a tactic scammers often use to steal sensitive data like bank details or verification codes (Techworm The Hacker News).
On Messenger, a new “Scam Detection” feature warns users about suspicious messages from unfamiliar senders. If flagged, users can submit recent messages for AI review, which then offers safety tips and options to block or report the sender (The Hacker NewsBleeping Computer).
To reinforce account security, Meta has introduced Passkey-based logins across WhatsApp, Messenger, Facebook, and Instagram. These use fingerprint, facial recognition, or device PINs to reduce the risk of unauthorized access (Techworm). The company also enhanced its Privacy and Security Checkup tools, helping users manage group chat settings, visibility controls, and password strength.
Behind the scenes, Meta has taken down over 8 million scam-linked accounts and 21,000 fake customer support pages in 2025 alone. Many of these were tied to organized scam centers operating in Southeast Asia and the Middle East, targeting users through romance scams, crypto fraud, and impersonation tactics ( Techworm The Hacker News DMR News).
These updates reflect Meta’s broader commitment to consumer protection and digital safety—especially for vulnerable users navigating increasingly sophisticated scam networks.
Sources: Techworm The Hacker News Bleeping Computer DMR News