Joint Warning on Iranian Cyber Espionage Targeting Activists

• •Iranian state-linked actors are using malware 'Chosen Break' for cyber espionage.
• •Targets include activists, journalists, and dissidents on platforms like WhatsApp and Telegram.
• •The FBI and UK authorities confirm ongoing surveillance and data theft operations.

On September 15, 2026, the UK, US, and Netherlands issued a joint warning about Iranian cyber espionage programs targeting activists, journalists, and dissidents. The UK's National Cyber Security Centre reported that Iranian state-linked actors employed malware known as 'Chosen Break' to steal sensitive information through targeted phishing campaigns on messaging platforms like WhatsApp and Telegram. The malware can access email, contacts, and even capture screen content and microphone audio. The FBI confirmed that Iran's Ministry of Intelligence and Security is using this malware for intelligence gathering and discrediting targets. This warning updates a previous advisory from March 2026, highlighting ongoing threats from a hacker known as 'Handala Hack.' The campaign has reportedly led to the exposure of personal data on pro-Iran leak sites. Authorities are urging vigilance against these targeted attacks.