UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan result, after initial contact on WhatsApp/Telegram while impersonating a known contact or technical support.
This campaign relied on long-running social engineering rather than technical exploits alone. Operators made initial contact with targets over WhatsApp or Telegram, often posing as a known contact or as technical support. Instead of pushing a malicious file immediately, they spent time building rapport and trust with the target before delivering it. One lure that stands out was a file disguised as a fake MRI scan of a disk herniation, a highly personal and emotionally charged pretext designed to lower the target's guard. Other lures impersonated legitimate software products, including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, so the malicious file matched whatever story the attacker was using.
The core reason this worked is trust. By the time the malicious file arrived, the target already believed they were talking to a known contact or a legitimate support agent. That rapport-building phase made the eventual file drop feel routine rather than suspicious. Tailoring the lure to something personal, like a medical scan, or something familiar, like a well-known app or antivirus tool, reduced the chance a target would pause and question the request. This approach targeted journalists, activists, and dissidents or opposition figures, groups who may already be dealing with high stress and urgency in their communications, making a convincing pretext even more effective.
Defenders and at-risk individuals should treat any unsolicited file sent over messaging apps as high risk, regardless of how familiar the sender seems, and verify the sender through a separate, known-good channel before opening anything. Real technical support should never deliver installers or fixes through chat apps. Because attackers may try to shift conversations to personal devices to bypass workplace protections, awareness guidance should extend beyond corporate systems. Once installed, this type of spyware can capture messages, screen activity, and audio, so the goal of training should be preventing the file from being opened in the first place, not just detecting it afterward.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Operators made initial contact over WhatsApp or Telegram, often posing as a known contact or technical support, built rapport with the target, and then sent a malicious file disguised as something innocuous, such as a fake MRI scan or legitimate software.
Victims included journalists, activists, and dissidents or opposition figures in the UK, US, and Netherlands.
The malware can steal contacts, email, and social messages, capture the screen, and turn on the microphone, enabling pattern of life tracking that can increase physical risk to the target.
Attackers disguised malicious files as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass.
Imagine a WhatsApp from a friend: “Here’s your MRI scan, looks like a disk herniation, open this file.” UK, US, and Dutch agencies say Iran-linked operators used that exact trick to drop spyware called CHOSEN BRICK, after weeks of chatting on WhatsApp or Telegram, posing as a friend or tech support. They’ve sent fake MRI scans and files pretending to be Norton, KeePass, Telegram, even Adobe Flash, shared directly in chat, not from any official site. Once opened, CHOSEN BRICK can read your email and messages, grab your contacts, record your screen, and turn on your mic. If you get any urgent MRI file or software installer over WhatsApp or Telegram, even from someone you trust, stop and call or message them on a separate, known-good channel to confirm before you open anything.
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
Western government agencies warn that Iranian state-backed actors are using WhatsApp and Telegram messages to trick targeted individuals into installing a Windows surveillance and data-stealing tool called “Chosen Brick.” The attackers build trust by impersonating known people or organizations,…
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
