Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and infecting their Windows devices, three Western intelligence agencies warned.
The UK’s National Cyber Security Centre, the FBI and the Netherlands’ AIVD said the campaign has targeted dissidents, activists and journalists in the UK, US and the Netherlands since at least 2025.
“CHOSEN BRICK enables Iranian state cyber actors to collect information on a target’s contacts, emails and social media messages, which could enable tracking of their movements,” reads the advisory.
“In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”
How the attacks start
The campaign begins with contact on messaging platforms, most often WhatsApp and Telegram. The attacker poses as someone the target already knows, or as technical support from the platform itself, and spends time building rapport before sending anything malicious.
Once trust is established, the target is persuaded to download and open a file. These have appeared as legitimate software, including fake versions of Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass. In other cases, the file was disguised as MRI scan results.
An example of the lure files (Source: Joint advisory)
The agencies note the attackers often try the target’s work device first. If that fails, or detection risk looks too high, they push the target to open the file on a personal device instead, which sidesteps whatever security controls the workplace has in place.
Built to stay hidden and survive reboots
The malware only infects Windows systems. It adds exclusions to Microsoft Defender to stay hidden, and it uses registry keys, most often the Run key at “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”, to survive a reboot.
“This will run the malware at user login for the user that was logged in when the malware was installed,” the advisory states.
CHOSEN BRICK has stayed confined to single devices so far, though its ability to download and install additional malware means it could technically be used to spread further, the agencies note.
The malware communicates with its operators through Telegram, and each infected device is assigned its own separate bot, so one discovered victim can’t be traced to others.
What gets stolen
From there, CHOSEN BRICK can log running processes and system details, capture screenshots, turn on the microphone, pull WhatsApp and Telegram data from browsers, steal emails, delete files, download further malware, or wipe the device outright.
The agencies flag screen capture as one of the most common ways the operation builds a picture of a victim’s contacts, location and daily routine. That data has, in some cases, later turned up published on pro-Iranian leak sites.
Because the campaign deliberately targets personal devices as well as work ones, the agencies are advising organizations to share the advisory with any staff who might be at risk, so they can check their own phones and laptops too.
“Organisations that are concerned CHOSEN BRICK has been executed should contact their IT providers, either internal or external, to investigate.”
Western governments have issued repeated warnings about Iranian cyber activity in recent months, especially since the US and Israel launched airstrikes on Iran on February 28, 2026.
In August, Iranian hackers were blamed for shutting down a small British power plant for four days. In April, US agencies warned of heightened Iranian activity targeting energy, water and government networks. And in late July, a coordinated attack on 30 Minnesota water utilities, though never formally confirmed, has also been linked to Iran.
