Iranian Hackers Target Dissidents with Persistent CHOSEN BRICK Spyware

The UK’s National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation and the Netherlands’ General Intelligence and Security Service (AIVD) have warned that Iranian state actors are targeting dissidents, activists and journalists, including people in the UK. The campaign uses spear-phishing and social engineering: attackers reportedly impersonate contacts on WhatsApp and Telegram, build rapport and tailor lures to victims’ interests. Some attempts have included fake MRI test results. The actors have also been observed stealing sensitive information that later appeared on leak sites.

The spyware, named CHOSEN BRICK, targets Windows devices and is persistent, surviving a reboot. According to the advisory, it can collect contacts, emails and social-media messages, capture screen content and access a device’s microphone. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of people seen as threats to its regime, although the article describes the activity as observed targeting attempts rather than confirming every attempted infection succeeded. It warns that exposed personal details may increase victims’ physical-safety risks.

The agencies recommend that people at risk study the advisory’s social-engineering indicators and mitigation steps, and that high-risk individuals use the NCSC’s dedicated support and free cyber-defence services. The NCSC also points to UK government guidance for people who suspect they are victims of transnational repression. The warning and associated FBI technical report were published on 15 September 2026.