Back Thenationalnews

Iran accused of using spyware to snoop on dissidents overseas

Thenationalnews • September 15, 2026

UK's National Cyber Security Centre warns state-linked cyber actors steal messages and sensitive information

Iranian government spyware snoops on dissidents , activists and journalists on messaging platforms including WhatsApp and Telegram, the UK, US and the Netherlands warned on Tuesday.

Britain's National Cyber Security Centre said the cyber actors had used a ⁠spyware family known as Chosen Brick to steal emails, messages ⁠and other ‌sensitive information through “spear-phishing” campaigns.

“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” Paul Chichester, NCSC Director of Operations, said in a statement.

Iranian graphic designers arrested for the 'crime' of meeting French diplomats

Iran's embassy in London did not immediately respond to a request for .

The malware can collect information from lists, emails and social media accounts, capture screen content and access microphones, the advisory warned. Some of the victims' personal details had later appeared on pro-Iranian leak sites, the NCSC said.

Attackers often posed as trusted contacts on messaging ⁠apps and tailored their approach to individual targets, the NCSC said.

This went so far as using fake documents and fabricated MRI test results to convince victims to download the malware.

The NCSC, alongside the FBI and the Netherlands' AIVD intelligence service, said Iran “almost certainly” uses cyber operations to help suppress people it sees as threats.

Last year, the UK, US and France were among more than a dozen countries to condemn what they called a surge in assassination, kidnapping and harassment plots by Iranian intelligence services against people in Europe and North America.

“We are united in our opposition to the attempts of Iranian intelligence services to kill, kidnap and harass people in Europe and North America in clear violation of our sovereignty,” the countries said.

The UK government previously said it had disrupted more than 20 Iran-linked plots to kidnap or kill people in the country since 2022, including British citizens and others Tehran views as threats.

Saudi Arabia discovers 110 million tonnes of uranium-concentrated ore in Madinah region

Qatar LNG won’t return to normal when Hormuz reopens, executives say

Dubai's Global Village announces opening date for season 31

UAE steps up scrutiny of academic certificates – with Dh30,000 fine among penalties for fakes

Cartoon for September 15, 2026

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

Iran accused of using spyware to snoop on dissidents overseas

The full story

Extracted Entities

Attack Types (2)

Countries (3)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)