Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
UK NCSC, FBI and Dutch AIVD warn Iranian state hackers deploy CHOSEN BRICK spyware via WhatsApp and Telegram lures against dissidents and journalists since 2025.
The UK's NCSC, the FBI and the Netherlands' AIVD jointly warned that Iranian state cyber actors have deployed CHOSEN BRICK against dissidents, activists and journalists in the UK, US and Netherlands since at least 2025. Victims are contacted on WhatsApp or Telegram by impostors posing as known contacts or platform support, then tricked into running files disguised as software such as fake Norton Antivirus, KeePass, Telegram or MRI scan results. The Windows malware adds Microsoft Defender exclusions, persists via HKCU Run keys, uses per-device Telegram bots for C2, and can capture screens, activate microphones, steal email and messaging data, and download further payloads. Some stolen data has later appeared on pro-Iranian leak sites, and the agencies note Iranian intelligence has plotted kidnappings or lethal operations against targets abroad.
- Joint NCSC-FBI-AIVD advisory attributes CHOSEN BRICK to Iranian state actors targeting dissidents, activists and journalists since 2025.
- Initial contact via WhatsApp or Telegram impersonation; lures pose as Pictory, RunwayML, Norton, Telegram, Flash Player, KeePass or MRI scans.
- Malware adds Defender exclusions, persists via HKCU Run key, and assigns each infected device a separate Telegram bot for C2.
- Capabilities include screen capture, microphone activation, email and messaging theft, file deletion, payload download and device wipe.
- Attackers try work devices first, then push targets to personal devices to bypass corporate security controls.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair DefensesT1113 Screen CaptureT1102 Web Service
- Threat actors
- Iranian state cyber actors
- Malware
- CHOSEN BRICK
From the original article
3 min read at helpnetsecurity.com
Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and infecting their Windows devices, three Western intelligence agencies warned.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.