Iranian Spyware Campaign Targets Dissidents With Chosen Brick Malware

The UK’s National Cyber Security Centre (NCSC), the FBI and the Netherlands’ General Intelligence and Security Service (AIVD) have warned that opponents of Iran’s regime may be targeted by a Tehran-backed spyware campaign. Their advisory, published on 15 September 2026, focuses on dissidents, activists and journalists critical of the Iranian government. The agencies said stolen information has in some cases appeared on pro-Iranian leak sites, potentially increasing risks to victims’ personal safety. The NCSC said the campaign has been active since at least 2025.

The campaign uses Chosen Brick, Windows spyware that can collect contacts, emails and social-media messages and track victims’ movements. It establishes persistence through Windows registry keys and adds exclusions to Microsoft Defender to avoid detection. The malware communicates with Telegram for command and control and can enumerate processes and system information, capture screens, obtain Telegram and WhatsApp data from browsers, steal emails and activate a device’s microphone. It can also delete files, download further malware and wipe a system, according to the NCSC.

Chosen Brick is delivered through social engineering. Attackers reportedly build trust on social media, often impersonating a contact or messaging-service support, before persuading targets to download a supposedly legitimate application such as Pictory, RunwayML, Norton Antivirus, Telegram or Adobe Flash Player, or to open a file such as an MRI scan. The advisory recommends that organisations help targeted staff investigate personal as well as corporate devices.

Defenders should review DNS and web-proxy logs, where the spyware’s use of legitimate web services may be visible, and apply updates, reputable antivirus, phishing-resistant MFA, application allowlisting and endpoint and network monitoring.