UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
Joint advisory details Iranian spear-phishing campaign deploying CHOSEN BRICK spyware to surveil dissidents, activists, and journalists across UK, US, Netherlands.
The NCSC (part of GCHQ), FBI, and AIVD jointly warned that Iranian state actors impersonate trusted contacts on WhatsApp and Telegram to deploy the CHOSEN BRICK spyware against dissidents, activists, and journalists worldwide. The Windows-only malware is persistent across reboots and collects contacts, emails, social media messages, screen captures, and microphone audio. Stolen personal details of some victims have been published on pro-Iranian leak sites. The FBI published complementary technical analysis, and the NCSC offers free cyber defence services for high-risk individuals.
- Iranian actors impersonate trusted contacts on WhatsApp and Telegram to deliver CHOSEN BRICK.
- Spyware collects screen captures, microphone audio, contacts, emails, and social media messages.
- Stolen victim details published on pro-Iranian leak sites; malware is Windows-only and persistent.
- FBI released complementary technical report; NCSC offers free cyber defence services to at-risk individuals.
From the original article
3 min read at ncsc.gov.uk
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
ncsc.gov.uk
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.