Table of Contents
Introduction
Britain, the United States, and the Netherlands have issued a joint cybersecurity advisory detailing spyware they say is used by Iranian state-linked actors to target dissidents, activists, and journalists.
The advisory, published on September 15, 2026, identifies a spyware family known as "CHOSEN BRICK" being used by Iranian state-linked cyber actors to steal emails, messages, and other sensitive information through spear-phishing campaigns on messaging platforms including WhatsApp and Telegram.
"The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices." — Paul Chichester, NCSC Director of Operations
What Is CHOSEN BRICK?
CHOSEN BRICK is a spyware family used by Iranian state-linked cyber actors to conduct surveillance on targets perceived as threats to the regime.
Key details:
- Attributed to Iran's Ministry of Intelligence and Security (MOIS)
- Used to collect intelligence, conduct data leaks, and inflict reputational harm against intended targets
- Distributed through spear-phishing campaigns on WhatsApp and Telegram
- Some victims' personal details have later appeared on pro-Iranian leak sites
The FBI said Iran's Ministry of Intelligence and Security (MOIS) was using the malware to "collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets."
What the Spyware Can Do
According to the joint advisory, CHOSEN BRICK can collect a wide range of sensitive information from infected devices:
| Capability | Description |
|---|---|
| Contact lists | Collect information from the victim's contacts |
| Emails | Access and steal email communications |
| Social media accounts | Gather information from connected social accounts |
| Screen content | Capture what's displayed on the device screen |
| Microphone access | Listen to and record audio from the device |
The spyware's ability to access microphones and capture screen content makes it particularly dangerous for journalists, activists, and dissidents who discuss sensitive topics on their devices.
Who Is Being Targeted
The advisory states that Iranian state-linked cyber actors are targeting:
- Dissidents — individuals who oppose the Iranian regime
- Activists — human rights advocates and political campaigners
- Journalists — reporters covering Iran and related topics
- Critics of the regime — anyone perceived as a threat to Iranian authorities
The FBI declined to share additional details on how many people have been targeted with the malware, or where they're located.
The NCSC, alongside the FBI and the Netherlands' AIVD intelligence service, said Iran "almost certainly" uses cyber operations to help suppress people it sees as threats.
Attack Tactics: Spear-Phishing on WhatsApp and Telegram
The NCSC said the attackers often posed as trusted contacts on messaging apps and tailored their approach to individual targets.
Notable tactics include:
- Impersonation — Posing as trusted contacts to build rapport
- Personalization — Tailoring messages to each individual target
- Fake documents — Using fabricated documents to persuade victims to download malware
- Fabricated MRI test results — In some cases, attackers used fake medical documents to trick victims
In some cases, attackers used fake documents — including fabricated MRI test results — to persuade victims to download the malware.
The Handala Hack Connection
The FBI's advisory is an update to a March 2026 warning describing alleged MOIS efforts to use the malware to collect data on targets, which was then posted online by a hacking persona known as "Handala Hack."
Handala Hack's track record:
- Targeted multiple U.S. companies and people since the start of the Iran war
- Conducted a destructive cyberattack against Stryker (SYK.N), a Michigan-based medical supplies and services supplier, in March
- Leaked FBI Director Kash Patel's personal emails later that month
The Joint Advisory Response
Three national cybersecurity agencies contributed to the advisory:
- UK National Cyber Security Centre (NCSC) — Provided details on the CHOSEN BRICK spyware family and attack tactics
- U.S. Federal Bureau of Investigation (FBI) — Attributed the malware to Iran's MOIS and described its intelligence objectives
- Netherlands' AIVD intelligence service — Joined the assessment that Iran uses cyber operations to suppress perceived threats
Iran's embassy in London did not immediately respond to a request for comment on the advisory.
How to Protect Yourself
If you are a journalist, activist, dissident, or work with sensitive information, take these steps:
1. Be Extremely Cautious on Messaging Apps
- Verify the identity of anyone contacting you on WhatsApp or Telegram
- Be suspicious of unsolicited messages, even from "trusted" contacts
- Use a second communication channel to confirm identity before sharing information
2. Don't Open Unexpected Documents
- Never open documents or files from unknown senders
- Verify the sender through another channel before opening any attachment
- Be especially cautious of medical documents, legal files, or other urgent-looking attachments
3. Enable Strong Security Settings
- Enable two-factor authentication on all accounts
- Use strong, unique passwords
- Keep devices and apps updated with the latest security patches
- Use encrypted messaging apps where possible
4. Monitor for Signs of Compromise
- Watch for unusual device behavior (battery drain, data usage spikes)
- Check for unexpected apps or permissions
- Monitor for suspicious login activity on your accounts
- Check if your information appears on leak sites
5. Use Mobile Security Tools
- Install reputable mobile security software
- Run regular scans on your devices
- Consider using a dedicated secure communication device for sensitive work
Taking these steps significantly reduces your risk from CHOSEN BRICK and similar state-sponsored spyware.
Final Thoughts
The joint advisory from the UK, US, and Netherlands highlights the ongoing threat posed by state-sponsored spyware. Iran's use of CHOSEN BRICK to target dissidents, activists, and journalists is a serious concern that requires vigilance from at-risk individuals and organizations.
Key takeaways:
- CHOSEN BRICK — Iranian state-linked spyware used to target dissidents, activists, and journalists
- Attributed to MOIS — Iran's Ministry of Intelligence and Security
- Distributed via spear-phishing — On WhatsApp and Telegram
- Capabilities — Contacts, emails, social media, screen capture, and microphone access
- Handala Hack connection — Leaked data posted online by Iranian-linked persona
- Joint advisory — UK NCSC, FBI, and Netherlands AIVD
- Protection — Verify contacts, avoid attachments, enable security, monitor for compromise
If your organization needs assistance with threat protection, spyware defense, or security assessments for at-risk personnel, contact SystemLogicIT for expert guidance across the United States and United Kingdom.