Back Today.Lorientlejour

UK, US and Netherlands issue advisory on Iran spyware - L'Orient Today

Today.Lorientlejour • September 15, 2026

Motorists drive past a large political billboard near Enghelab Square, in central Tehran, on May 26, 2026. (Credit: Atta Kenare/AFP)

Britain, the United States and the Netherlands on Tuesday issued a joint cybersecurity advisory detailing spyware they say is used by Iranian state-linked actors to target dissidents, activists and journalists, Reuters reported.

Britain's National Cyber Security Centre said Iranian state-linked cyber actors had used a spyware family known as "CHOSEN BRICK" to steal emails, messages and other sensitive information through "spear-phishing" campaigns on messaging platforms including WhatsApp and Telegram.

Already have an account? Login here

You have reached your article limit

Add L'Orient Today to your syllabus.

Already have an account? Login here

UK, US and Netherlands issue advisory on Iran spyware

Class is in session. Add L'Orient Today to your syllabus.

Already have an account?

You have 2 free articles left

You have 1 free article left

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

UK, US and Netherlands issue advisory on Iran spyware - L'Orient Today

The full story

Extracted Entities

Attack Types (2)

Countries (3)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)