Threats · 44 days ago
Chosen brick shifts infection to personal devices The UK NCSC, FBI and AIVD say Iranian state cyber actors have used CHOSEN BRICK since at least 2025 against dissidents, activists and journalists, and the joint advisory adds that operators will move the lure from a blocked work device to the target’s personal device. The malware has only been seen on Windows systems.
CHOSEN BRICK starts with trust-building on WhatsApp or Telegram, then a fake app or file. Once opened, it sets Windows registry persistence, adds Microsoft Defender exclusions, and uses Telegram for command and control, so the infection can survive reboots and hide from local security tools.
The key change is where the defense breaks: if the work machine resists, the attack simply relocates to an unmanaged phone or laptop, where enterprise monitoring and policy no longer follow. For teams that support at-risk people who are reachable over messaging apps, the exposure now sits as much on personal endpoints as on managed ones.
Timeline Sources 7 sources covering this story
BleepingComputer Sep 16
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.
SecurityWeek Sep 16
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.
Help Net Security Sep 16
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists - Help Net Security
Iranian state hackers use CHOSEN BRICK malware to spy on dissidents, activists and journalists via WhatsApp and Telegram.
Infosecurity Magazine Sep 16
NCSC and Allies Warn of Iranian Spyware Campaign
The UK’s National Cyber Security Centre says Iranian Chosen Brick spyware is designed to snoop on dissidents
The Register Security Sep 15
Iranian spies hit Windows machines with Chosen Brick data-stealing malware
'Enemies of the regime' on notice
The Hacker News Sep 15
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
U.S., U.K., and Dutch agencies say Iran’s intelligence service uses Telegram-controlled Windows malware to spy on dissidents and journalists.
UK NCSC Sep 15
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
UK NCSC Sep 15
Iranian cyber targeting of dissidents, activists and journalists
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
Entities Iranian state cyber actors Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-17
Editions Related stories Threats · 44 days ago
Chosen brick shifts infection to personal devices The UK NCSC, FBI and AIVD say Iranian state cyber actors have used CHOSEN BRICK since at least 2025 against dissidents, activists and journalists, and the joint advisory adds that operators will move the lure from a blocked work device to the target’s personal device. The malware has only been seen on Windows systems.
CHOSEN BRICK starts with trust-building on WhatsApp or Telegram, then a fake app or file. Once opened, it sets Windows registry persistence, adds Microsoft Defender exclusions, and uses Telegram for command and control, so the infection can survive reboots and hide from local security tools.
The key change is where the defense breaks: if the work machine resists, the attack simply relocates to an unmanaged phone or laptop, where enterprise monitoring and policy no longer follow. For teams that support at-risk people who are reachable over messaging apps, the exposure now sits as much on personal endpoints as on managed ones.
Timeline Sources 7 sources covering this story
BleepingComputer Sep 16
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.
SecurityWeek Sep 16
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.
Help Net Security Sep 16
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists - Help Net Security
Iranian state hackers use CHOSEN BRICK malware to spy on dissidents, activists and journalists via WhatsApp and Telegram.
Infosecurity Magazine Sep 16
NCSC and Allies Warn of Iranian Spyware Campaign
The UK’s National Cyber Security Centre says Iranian Chosen Brick spyware is designed to snoop on dissidents
The Register Security Sep 15
Iranian spies hit Windows machines with Chosen Brick data-stealing malware
'Enemies of the regime' on notice
The Hacker News Sep 15
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
U.S., U.K., and Dutch agencies say Iran’s intelligence service uses Telegram-controlled Windows malware to spy on dissidents and journalists.
UK NCSC Sep 15
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
UK NCSC Sep 15
Iranian cyber targeting of dissidents, activists and journalists
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
Entities Iranian state cyber actors Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-17
Editions Related stories