Back Devdiscourse

Unmasking 'CHOSEN BRICK': Iran's Digital Surveillance Weapon | Law

Devdiscourse • September 15, 2026

A joint cybersecurity advisory by the UK, the US, and the Netherlands highlights the use of Iranian-linked spyware 'CHOSEN BRICK' targeting dissidents and journalists. The details reveal extensive digital surveillance, with personal data accessed and shared on pro-Iranian leak sites to repress critics of the regime.

A joint cybersecurity alert has been issued by the United Kingdom, United States, and the Netherlands regarding Iranian state-linked actors utilizing spyware to silence dissenting voices.

The spyware, dubbed 'CHOSEN BRICK,' has been exploited in spear-phishing campaigns, targeting messaging apps like WhatsApp and Telegram to steal emails, messages, and other sensitive information.

Authorities believe such cyber operations are used by Iran for suppressing perceived threats, leading to information leaks and reputational damage. This marks a continuation of past efforts to surveil and control through digital means.

(With inputs from agencies.)

High-Stakes Diplomacy: U.S. and China on Economic Frontlines

Spyware Surge: Iranian Cyber Tactics Unveiled

U.S. Treasury Secretary Addresses Rising Bond Yields Amid Global Challenges

Digital Deceit: Iran's Espionage Empire Exposed

U.S. Treasury Secretary to Meet Chinese Vice Premier Ahead of Trump-Xi Talks

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Cyber Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding the CHOSEN BRICK malware, used by Iranian state-linked actors to target dissidents, activists, and journalists. This spyware is delivered through spear-phishing campaigns on messaging platforms like WhatsApp and Telegram, enabling attackers to steal sensitive information such as emails, messages, and contacts. The malware can also capture screen content and activate device microphones. The advisory highlights that the Iranian regime utilizes such cyber operations to suppress perceived threats, with some victims' personal details appearing on pro-Iranian leak sites. The campaign has been active since at least 2025, with a focus on individuals in the UK, US, and the Netherlands. Attackers often impersonate trusted contacts to build rapport before delivering the malware disguised as legitimate software. The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS). 27 sources 79

Extracted Entities

Unmasking 'CHOSEN BRICK': Iran's Digital Surveillance Weapon | Law

The full story

Extracted Entities

Attack Types (2)

Countries (3)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)