When an infected image arrived, the background image renderer extracted and executed the hidden payload without user interaction. Once inside the device, the malware modified SELinux policies, granting itself extended privileges to access private data and bypass sandboxing. Landfall's operators could pull extensive information from the phones, including device identifiers, installed applications, contacts, file directories, and browser data. The spyware could even activate microphones and cameras remotely.