Iranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents

• •CHOSEN BRICK spyware targets dissidents, activists, and journalists globally.
• •Attackers use social engineering via WhatsApp and Telegram to deliver malware.
• •Victims' personal details have been leaked on pro-Iranian sites, heightening risks.

On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding a spyware campaign attributed to Iranian state actors targeting dissidents, activists, and journalists. The malware, known as CHOSEN BRICK, is delivered through spear-phishing attacks on messaging platforms like WhatsApp and Telegram. Attackers impersonate trusted contacts to convince victims to download malicious files disguised as legitimate applications, including Norton Antivirus and KeePass. Once installed, CHOSEN BRICK can access sensitive information, including emails, contacts, and screen content, and can activate the device's microphone. The malware has been in use since at least 2025, and personal details of victims have appeared on pro-Iranian leak sites, increasing their risk. The advisory highlights the Iranian regime's use of digital surveillance to repress critics and outlines mitigation strategies for potential targets.