Back Devdiscourse

Digital Deceit: Iran's Espionage Empire Exposed | Law-Order

Devdiscourse • September 15, 2026

The UK, US, and Netherlands issued a joint advisory Iranian state-linked actors using spyware called 'CHOSEN BRICK' to target dissidents and journalists. The malware steals emails and sensitive data through spear-phishing on platforms like WhatsApp and Telegram, aiming to suppress regime critics.

On Tuesday, a joint cybersecurity advisory was released by Britain, the United States, and the Netherlands, exposing the use of spyware by Iranian state-linked actors to target dissidents, activists, and journalists.

Iranian cyber actors have been employing a spyware family known as "CHOSEN BRICK" to steal emails, messages, and other sensitive information through spear-phishing campaigns on messaging platforms such as WhatsApp and Telegram, according to Britain's National Cyber Security Centre.

The advisory reports that the malware can gather data from lists, emails, and social media accounts, and even access a device's microphone, revealing Iran's strategic use of cyber operations to suppress perceived threats.

(With inputs from agencies.)

Unmasking 'CHOSEN BRICK': Iran's Digital Surveillance Weapon

U.S. Treasury Secretary Addresses Rising Bond Yields Amid Global Challenges

U.S. Treasury Secretary to Meet Chinese Vice Premier Ahead of Trump-Xi Talks

Global Alert: Iranian Spyware Targeting Activists Revealed

Global Headlines: Sanctions, Politics & Social Unrest

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

Digital Deceit: Iran's Espionage Empire Exposed | Law-Order

The full story

Extracted Entities

Attack Types (3)

Countries (3)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)