State Actors Target Consumer Messaging Apps for Cyber Espionage

• •State actors are using consumer messaging apps as primary attack vectors.
• •Attackers gain trust before delivering malware disguised as legitimate files.
• •The CHOSEN BRICK malware targets dissidents and activists in multiple countries.

In October 2026, the FBI, UK's NCSC, and Netherlands' AIVD issued a coordinated advisory warning that state actors are exploiting consumer messaging platforms like WhatsApp and Telegram to compromise targets. The advisory details a method where attackers impersonate known contacts to gain trust before delivering malware disguised as legitimate files. The malware, identified as CHOSEN BRICK, has been used against dissidents and activists since at least 2025. The attacks leverage the inherent trust in messaging apps, allowing attackers to bypass traditional security measures. No specific CVEs were cited, and the advisory emphasizes the importance of initial access rather than exploiting vulnerabilities. The advisory highlights that the malware persists on infected devices and communicates via Telegram, complicating detection efforts. The ongoing threat affects individuals and organizations using these messaging platforms.