Skip to content
UK, US and Netherlands issue advisory on Iran spyware

UK, US and Netherlands issue advisory on Iran spyware

Ground.News • September 15, 2026

The advisory says CHOSEN BRICK can steal emails and messages, and that victims’ personal details later appeared on pro-Iranian leak sites.

On Tuesday, Britain, the United States, and the Netherlands issued a joint cybersecurity advisory detailing spyware known as "CHOSEN BRICK" used by Iranian state-linked actors to target dissidents, activists, and journalists.

Attackers often pose as trusted contacts on WhatsApp and Telegram , using fake documents including fabricated MRI results to conduct spear-phishing campaigns and persuade victims to download the malware.

The FBI stated Iran's Ministry of Intelligence and Security uses the malware to collect intelligence and inflict reputational harm, with victim details appearing on pro-Iranian leak sites linked to "Handala Hack."

NCSC director of operations Paul Chichester stated Iran "almost certainly" uses cyber operations to suppress perceived threats, stealing emails and messages to repress critics of the regime.

Since the start of the Iran war, the persona "Handala" has targeted multiple United States entities, including a destructive cyberattack against Michigan-based supplier Stryker and the leak of FBI Director Kash Patel's emails.

Three Western Countries Are Warning of Iranian Spying Programs.

On Tuesday, Britain, the United States and the Netherlands issued a joint e-security alert detailing spy programs that Iran's associates use to target opponents, activists, and journalists. The British National Centre for Electronic Security said that Iranian state-related destinations used a series of spy programs known as Chuzen Brekke to steal e-mails, messages, and other sensitive information through "directed hunting" campaigns on messaging…

Iranian Hackers Use Fake Norton Antivirus to Spread Windows Spyware

The FBI warns Iranian state- hackers spreading 'Chosen Brick' spyware through fake apps that pose as password manager KeePass and messaging app Telegram.

Britain, America and the Netherlands Are Issuing a Warning Iranian Spying Programs.

Today, on Tuesday, Britain, the United States and the Netherlands issued a joint warning against the use of spying programmes by Iran-affiliated groups to target opponents, activists and journalists.

Iranian state actors targeting dissidents and activists with spyware

Iranian agents used social engineering tricks such as fake MRI test results to lure victims in, the NCSC said

UK, USA and Netherlands Issue Spyware Alert Linked to Iran

On Tuesday, the United Kingdom, the United States and the Netherlands issued a joint cybersecurity alert detailing a spy software that, according to the three countries, is used by agents linked to Iran to target dissidents, activists and journalists.

UK, US, Netherlands Issue Advisory on Iran-Linked Spyware

Britain, the United States, and the Netherlands on Tuesday issued a joint cybersecurity advisory detailing spyware they say is used by Iranian state-linked actors to target...

48 % of the sources lean Right

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

Platforms (1)

Tools (1)