STATUS: Coordinated Multi-Government Advisory SEVERITY: 6/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Secure Communications
In coordinated advisories published the same week, the FBI, the UK's National Cyber Security Centre, and the Netherlands' AIVD intelligence service each warned that state- actors are now using consumer messaging platforms as a primary vector for compromise, not as one method among many. The advisories from three allied agencies trace initial access to consumer messaging apps, where any party holding a number or a username can open a conversation and spend weeks earning trust before a file ever appears.
The UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands’ General Intelligence & Security Service (AIVD) published a join advisory on September 15, 2026 covering CHOSEN BRICK, a Windows Spyware family used against dissidents, activists, and journalists in the three countries (and abroad) since at least 2025. The advisory cites no CVE. Nothing in the chain is exploited. Initial access is the focus of the conversation. Each advisory detailed the same pattern of trusted- impersonation, malware delivered directly through popular chat apps, and ongoing surveillance conducted through the same channels victims use to communicate.
Attackers research the target, then open that conversation on WhatsApp, Telegram, or social media while posing as a known or as technical support, building rapport over days or weeks before any file appears. The payload is a Windows executable dressed as something ordinary: Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, and in some cases MRI scan results. Running it shows a plausible screen matching the lure while the core component installs behind it.
No messaging app was defeated in this chain. The aspect the attackers exploited is reachability. A consumer platform is built so that anyone holding a number or a username can start a conversation and the target's only test of who sits on the other end is judgment. The advisory records that judgment failing after weeks of patient . The design of the attacks is deliberate. Traffic to widely used, encrypted consumer messaging services blends into normal network activity, sidestepping security teams and avoiding detection that would otherwise happen when unfamiliar infrastructure is used.
Delivery follows the same logic. Initial delivery often aims at the work or corporate device and when that fails, or when the risk of detection there is judged significant, the actor asks the target to open the file on a personal device instead. Device controls are never tested fully by the attacker. Instead, they move the target to a device where they do not apply.
On the host, CHOSEN BRICK persists through a Run key under HKCU and adds a Microsoft Defender exclusion. Command & Control runs over Telegram with a distinct bot ID per victim device so that one discovery doesn’t expose the others. Exfiltration goes to Telegram and to commodity cloud storage. Capabilities include screen capture, microphone capture, theft of email, and Telegram/WhatsApp data. The agencies observed no automated lateral movement; the malware focuses on single devices. No agency published a victim count. Personal details of some earlier victims have appeared on leak sites which puts physical safety in scope alongside the data loss.
What They Found and What It Means
BlackBerry Secure Communications Position
Encryption is not the failure point. The malware excludes itself from the host’s antivirus and runs command and control through a service the network already carries. Organizations that still treat that app as separate from their real security posture are drawing a line that state- actors have already stopped respecting. Procurement should be focused not on which product blocks which files or attacks. Permission to connect, converse, and your people in the first place is the solution to these attacks.
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists (UK National Cyber Security Center, September 15, 2026).
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists (UK National Cyber Security Center, September 15, 2026).
Iranian Cyber Targeting of Dissidents, Activists and Journalists (Advisory UK National Cyber Security Center, September 15, 2026).
Iranian Cyber Targeting of Dissidents, Activists and Journalists (Advisory UK National Cyber Security Center, September 15, 2026).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
