Back Independent

Warning issued after spyware used by Iranian state actors to target dissidents

Independent • September 15, 2026

Please refresh the page or navigate to another page on the site to be automatically logged in Please refresh your browser to be logged in

Swipe for article

British intelligence, alongside US and Dutch allies, has warned that Iranian state actors have targeted dissidents, activists, and journalists with spyware called Chosen Brick.

The malware grants Iranian agents access to victims' contacts, emails, social media messages, microphones, and screen content.

Operatives used social engineering tactics, including fake MRI test results, to trick targets into installing the Windows-targeting spyware.

The FBI confirmed that Iran 's Ministry of Intelligence and Security has deployed the malware since autumn 2023 to collect intelligence and cause reputational damage.

The National Cyber Security Centre has published technical advice to help at-risk individuals strengthen their online security against digital surveillance campaigns.

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged in Please refresh your browser to be logged in

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding a spyware campaign attributed to Iranian state actors targeting dissidents, activists, and journalists. The malware, known as CHOSEN BRICK, is delivered through spear-phishing attacks on messaging platforms like WhatsApp and Telegram. Attackers impersonate trusted contacts to convince victims to download malicious files disguised as legitimate applications, including Norton Antivirus and KeePass. Once installed, CHOSEN BRICK can access sensitive information, including emails, contacts, and screen content, and can activate the device's microphone. The malware has been in use since at least 2025, and personal details of victims have appeared on pro-Iranian leak sites, increasing their risk. The advisory highlights the Iranian regime's use of digital surveillance to repress critics and outlines mitigation strategies for potential targets. 72 sources 78

Extracted Entities

Warning issued after spyware used by Iranian state actors to target dissidents

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)