Hackers Exploit Bixby to Access Samsung Phones for $50,000

Exploiting Samsung's Software Vulnerabilities

At the recent Black Hat conference, security researchers revealed how they exploited vulnerabilities within Samsung software, particularly focusing on the Bixby virtual assistant, to hack into mobile devices. The work, conducted by Dimitrios Valsamaras from Microsoft and Ken Gannon from Mobile Hacking Lab, illustrates significant security concerns affecting Samsung smartphones. Their findings were demonstrated during the Pwn2Own Ireland hacking competition in October 2025, where they netted $50,000 for their successful exploit of a Samsung Galaxy S25.

How the Exploit Works

The researchers outlined a multi-stage exploit chain that commences with an attacker tricking the user into clicking a malicious link typically distributed through ads or messaging applications. This initial step leverages a vulnerability identified as CVE-2025-21079, which coerces the Samsung Members application—a community and support tool preinstalled on many Galaxy devices—to connect to a malicious website.

From Samsung Members to Bixby

Once the connection is established, a separate vulnerability, CVE-2025-58486, is triggered, causing the Samsung Account app to connect to another attacker-controlled site. This site then exploits an XSS vulnerability, tracked as CVE-2025-58487, enabling the malicious website to launch Bixby directly.

Understanding the Attack Vector

According to Gannon, the reason this is feasible is that the Samsung Account app holds a specific permission that acts as a ‘key’ allowing it to access a particular entry point within Bixby. By abusing this arrangement, attackers can direct Bixby to utilize various Capsules—which are background services within apps designed to facilitate functionality.

Capsules: A Backdoor Entry

Capsules behave like mini internal servers and perform tasks based on voice commands issued through Bixby. Normally, Samsung restricts which applications are permitted to interact with these Capsules. However, the researchers were able to reverse-engineer this structure, allowing them to control Capsules in malevolent ways.

With this capability established, an attacker can exfiltrate sensitive data from the device and gain system-level permissions—the most privileged access available on those devices. Once they achieve this level of access, attackers can execute remote code and effectively take control of the user's smartphone.

Devices Vulnerable to the Exploit

The demonstration successfully targeted the Galaxy S25, S24, and Flip 7 devices. However, Gannon and Valsamaras warned that older Samsung models, which may not have received the necessary patches, remain susceptible to these vulnerabilities. Interestingly, a specific condition must be met: all the targeted applications, like Samsung Account and Bixby, need to be installed for the exploit to be effective.

Samsung's Response to the Threat

In response to the findings presented at Pwn2Own, Samsung acted swiftly to patch the vulnerabilities. The company rolled out updates for the Samsung Members application in November 2025, which prevented the exploit chain from being activated through browsers or messaging platforms. Further patches to address the weaknesses in Samsung Account followed in December 2025.

While newer devices may now be secure, older models—particularly those in the budget category—may continue to face risks due to the lack of timely updates.

Implications for Samsung Users

This research highlights severe implications for Samsung device users, particularly the potential exploits that can occur when malicious software tricks users into interacting with compromised applications. As this security incident demonstrates, even widely used features like Bixby can become conduits for attacks if apps are not adequately secured.

Future Considerations in Mobile Security

As mobile devices continue to be integral parts of daily life, the need for stringent security measures becomes increasingly critical. This demonstration serves as a wake-up call for both consumers and manufacturers regarding the importance of regular security updates and awareness of potential vulnerabilities in widely used applications.

Key Takeaways

• The exploits involved vulnerabilities CVE-2025-21079, CVE-2025-58486, and CVE-2025-58487.
• The exploit chain enabled unauthorized access to Bixby and other Samsung applications.
• Samsung's patches were released in November and December 2025 for the affected applications.
• The attack successfully targeted flagship devices, although older models remain at risk.
• Effective mobile security requires prompt updates and awareness of exploitation tactics.

Overall, the research underscores the necessity for continuous vigilance in mobile security practices, urging users to keep their devices up to date and to remain aware of potential social engineering attacks designed to exploit their trust in legitimate applications.