Iranian Hackers Target Dissidents With CHOSEN BRICK Malware

The UK National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation and the Netherlands’ AIVD have warned that Iranian state cyber actors have used CHOSEN BRICK malware against individuals, including dissidents, activists and journalists, in the UK, US and Netherlands since at least 2025. The malware can collect contacts, emails, social-media messages, screenshots and microphone recordings, potentially helping operators track a victim’s movements and pattern of life. Details of some victims have reportedly appeared on pro-Iranian leak sites, increasing potential safety risks.

The campaign relies on tailored social engineering through platforms including WhatsApp and Telegram. Operators build rapport while posing as trusted contacts or technical support, then persuade targets to open apparently legitimate software or documents, including files masquerading as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass or MRI results. Observed infections have targeted Windows devices.

CHOSEN BRICK persists through the registry Run key at `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, can add Microsoft Defender exclusions and uses Telegram bots for command and control. It has been observed downloading further malware, although automated lateral movement has not been seen.

The agencies advise organisations concerned about possible compromise to involve their IT providers, search logs for the advisory’s indicators and detection signatures, and help staff check personal Windows devices. Investigators should review the Run key and unexpected connections to services including `api.telegram.org`, `vultrobjects.com` and `storjshare.io`.

Recommended protections include avoiding software delivered through unsolicited links or attachments, keeping systems and antivirus updated, enabling phishing-resistant multi-factor authentication, using application allowlisting, and deploying endpoint and network monitoring.