Back Newsbook.Mt

Iranian spyware campaign targeted journalists and activists

Newsbook.Mt • September 15, 2026

Iranian state-linked hackers have been targeting journalists, activists and dissidents in an international spyware campaign, according to British intelligence.

The UK’s National Cyber Security Centre (NCSC), which forms part of GCHQ, said the operation was uncovered alongside authorities in the United States and the Netherlands.

According to the NCSC, those behind the campaign attempted to persuade selected targets to download malicious software capable of monitoring their activity and extracting sensitive information.

In some cases, the hackers allegedly impersonated people known to their targets through messaging platforms such as WhatsApp.

They would then attempt to build trust before encouraging the person to install spyware known as “CHOSEN BRICK”.

Once installed, the spyware could give attackers access to a wide range of information stored or displayed on the device.

This included screenshots, messaging history, email information, social media messages and details the victim’s contacts.

The NCSC said the spyware could also be used to capture what was being displayed on a screen and gain access to a device’s microphone.

British intelligence said the activity had been linked to Iranian state cyber actors.

The NCSC has now issued new guidance aimed at helping people considered particularly vulnerable to such attacks protect themselves from similar attempts.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

Iranian spyware campaign targeted journalists and activists

The full story

Extracted Entities

Attack Types (1)

Countries (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)