LANDFALL Android Spyware SELinux Policy Manipulation

doyou know@doyouknow

•updated Nov 7, 2025•10•1•102

Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.