'Chosen Brick' malware used to collect information on dissidents, journalists and activists around the world
The UK's National Cyber Security Centre, with partners in the USA and the Netherlands, has exposed an Iranian spyware campaign to help victims identify and counter the threat.
Individuals deemed to present a threat to the Iranian regime, including dissidents, activists and journalists, are among those the country targeted with the 'Chosen Brick' spyware.
The victims are not solely Iranian citizens or located in Iran, but in the UK and other countries as well. Some victims' personal details have already been posted to pro-Iranian leak sites.
According to an advisory from the NCSC and its partners, the Chosen Brick malware family has been in use since at least 2025. Iranian state actors use it to collect information on a target’s contacts, emails and social media messages, which may enable their movements to be tracked.
"In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime," the advisory adds.
Iranian actors often use social engineering to deploy Chosen Brick – impersonating known contacts on messaging apps, tailoring their approach based on areas of interest or relevance, and stealing sensitive information.
The initial malicious payload can be disguised as legitimate apps like Norton Antivirus or Adobe Flash Player. It appears to focus on single devices, and has not been observed displaying lateral movement capabilities. However, it does deploy additional malware, using Telegram for command and control to blend in with authentic processes.
The malware has a variety of functions enabled through the Telegram bot, including capturing screen content, using the device's microphone to capture audio content, stealing email content and deleting files – or even wiping an entire computer system.
Josiah Smith, Director of Operations at OPSWAT, said the combination of long-con lures with a surveillance tool only targeting Windows devices is consistent with Iran's former targeting of dissidents, journalists and activists, "where the goal is identifying who someone is talking to and what they're saying, not just breaching an account."
"Anyone in a high-risk category - exiled activists, journalists covering Iran, NGO staff - should treat unsolicited -building on messaging apps as the first stage of an attack, not the endgame, and follow NCSC's mitigation guidance for high-risk individuals," Josiah added.
The NCSC has published an analysis of Chosen Brick , which includes advice to help individuals and organisations protect themselves.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
