Chosen Brick, Iran’s Surveillance Malware
UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.
70
Malware
CHOSEN BRICK
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 16, 2026
- Last mentionedSep 17, 2026
Timeline
7 articles · newest firstIranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
78
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch agencies warn Iranian state actors deploy Windows surveillance malware 'Chosen Brick' against dissidents, activists, and journalists worldwide.
60
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
UK NCSC, FBI and Dutch AIVD warn Iranian state hackers deploy CHOSEN BRICK spyware via WhatsApp and Telegram lures against dissidents and journalists since 2025.
78
Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware
Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.
74
NCSC and Allies Warn of Iranian Spyware Campaign
NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.
76
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.
72
Appears with
- FBIorganization · 7
- Telegramproduct · 6
- NCSCorganization · 6
- Microsoftvendor · 5
- Microsoft Defenderproduct · 5
- AIVDorganization · 5
- WhatsAppproduct · 4
- Iranthreat actor · 3
- Chosen Brickproduct · 3
- Iranian state cyber actorsthreat actor · 2
- Iranian state-linked hackersthreat actor · 1
- Iranian intelligence servicesthreat actor · 1
- NCSCvendor · 1
- RunwayMLproduct · 1
- HEAVYGRAMmalware · 1
- Pictoryproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.