Booby-trapped images sent over WhatsApp targeted Samsung phones through a flaw in an image library

Between July 2024 and February 2025, six suspicious image files were uploaded to VirusTotal. After a lead from Meta, they came to the attention of Google's Threat Intelligence Group. Investigators found that the files were DNG images designed to attack the Quram library, an image parsing component specific to Samsung devices. Unit 42 published a blog post on 7 November 2025 describing how the exploits were used and the spyware they delivered. Project Zero's write-up focuses on the technical workings. Samsung fixed the vulnerability in April 2025.

Several of the filenames suggested the images arrived over WhatsApp, following the naming used by WhatsApp on Android and WhatsApp Web. Two images appeared to have been received on the same day, possibly by the same target. One was built for the jemalloc memory allocator and the other for scudo, which is used on more recent Android versions and is more hardened. The final payload expected to run inside a Samsung process called com.samsung.ipservice.

This process is a Samsung system service that provides AI-powered features to other Samsung apps, and it periodically scans and parses images and videos in Android's MediaStore. When WhatsApp downloads an image, it adds it to the MediaStore. That means a received image could reach the vulnerable parsing code in the Samsung service. Project Zero notes that this kind of one-shot, image-based Android exploit has received less public documentation than similar attacks on iOS.