Back Devdiscourse

Global Alert: Iranian Spyware Targeting Activists Revealed | Law-Order

Devdiscourse • September 15, 2026

Britain, the United States, and the Netherlands have issued a joint cybersecurity warning Iranian state-linked actors targeting dissidents, activists, and journalists using spyware. Known as 'CHOSEN BRICK', this spyware campaigns via platforms like WhatsApp and Telegram, stealing sensitive information through spear-phishing tactics.

An unprecedented cybersecurity alert was jointly issued by Britain, the United States, and the Netherlands, cautioning against Iranian spyware targeting dissidents and activists.

The UK's National Cyber Security Centre identified 'CHOSEN BRICK' as the weapon of choice for Iranian-linked hackers, exploiting platforms like WhatsApp and Telegram with spear-phishing attacks.

The advisory urges heightened vigilance and protective measures among potential targets, spotlighting the ongoing global cyber threat landscape.

(With inputs from agencies.)

Spyware Surge: Iranian Cyber Tactics Unveiled

Unmasking 'CHOSEN BRICK': Iran's Digital Surveillance Weapon

Digital Deceit: Iran's Espionage Empire Exposed

Prepping for Election Interference: Are States Ready to Defend Their Vote?

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

Global Alert: Iranian Spyware Targeting Activists Revealed | Law-Order

The full story

Extracted Entities

Attack Types (1)

Countries (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)