The UK NCSC, FBI and AIVD say Iranian state cyber actors have used CHOSEN BRICK since at least 2025 against dissidents, activists and journalists, and the joint advisory adds that operators will move the lure from a blocked work device to the target’s personal device. The malware has only been seen on Windows systems.
CHOSEN BRICK starts with trust-building on WhatsApp or Telegram, then a fake app or file. Once opened, it sets Windows registry persistence, adds Microsoft Defender exclusions, and uses Telegram for command and control, so the infection can survive reboots and hide from local security tools.
The key change is where the defense breaks: if the work machine resists, the attack simply relocates to an unmanaged phone or laptop, where enterprise monitoring and policy no longer follow. For teams that support at-risk people who are reachable over messaging apps, the exposure now sits as much on personal endpoints as on managed ones.
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.