UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then push victims to download a “legitimate” app or enticing file (like an “MRI scan”). Stolen emails and messages have reportedly been posted to pro-Iranian leak sites, raising real-world safety risks.
A Tehran-backed operation uses social engineering, not technical exploits, to get spyware onto a target's device. The threat actor first builds rapport with the victim on social media, usually by impersonating a known contact or posing as social messaging technical support. Once trust is established, the attacker persuades the victim to download something that looks legitimate: a real-sounding app such as Pictory, RunwayML, Norton Antivirus, Telegram, or Adobe Flash Player, or an enticing file like an MRI scan. That download is weaponized to install spyware known as Chosen Brick, which can steal contacts, emails, and social media messages, capture screens and audio, and in some cases wipe the device entirely.
The operation relies on borrowed trust rather than malware sophistication at the delivery stage. Impersonating a known contact or a support account removes the skepticism a cold message from a stranger would trigger. Framing the payload as a familiar, well-known app name, or as a sensitive personal file needing urgent attention, gives victims a plausible reason to bypass normal caution. Because targets often use personal devices for sensitive work, requests to install software feel routine rather than suspicious, and there is no formal IT process to flag the request as unusual.
Organizations supporting journalists, activists, NGO staff, and other high-risk individuals should treat any in-chat software install request as suspicious by default, verifying it through a separate trusted channel before acting. Staff should be reminded never to click download links or open attachments sent via chat, and to install software only from official vendor sources while heeding, rather than dismissing, security warnings. Because this campaign targets personal devices as much as corporate ones, security guidance needs to extend beyond the corporate perimeter, including help for staff in checking their personal phones and accounts. Finally, organizations should plan for the fact that stolen communications may be exposed on leak sites, which raises both cybersecurity and personal safety considerations for those affected.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Chosen Brick is spyware tied to a Tehran-backed campaign that steals contacts, emails, and social media messages, and can capture screens, audio, and potentially wipe systems.
Government advisories warn that opponents of the Iranian regime, including dissidents, activists, and journalists, may be targeted, along with staff in high-risk roles who use personal devices for work.
Attackers build rapport on social media by impersonating a known contact or social messaging technical support, then persuade the victim to download a legitimate-looking app or an enticing file such as an MRI scan.
NCSC advises avoiding download links and attachments, enabling automatic updates and antivirus, not ignoring download warnings, and helping at-risk staff check their personal devices as well as corporate ones.
If you speak out on Iran, assume your DMs are a target, UK agencies say Tehran-backed spyware is hunting dissidents, activists, and journalists. The move is sneaky: on Telegram, someone who looks like a friend or 'Social Messaging Support' chats for a bit, then says, 'Hey, install Pictory or this Norton update from my link.' That link drops the 'Chosen Brick' spyware that can read your emails, social messages, even record screens and audio. Here’s the part people miss: the app name looks legit, Pictory, RunwayML, Telegram, even an 'MRI scan' file, but the install link came in a chat, not from the official app store or vendor site. That tiny detail is the tell. If anyone DMs you to install software or open an 'MRI scan', stop, don’t touch the link. Instead, go to the official app store or vendor site yourself, and if it feels even slightly off, verify with that person or support on a separate channel.
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
Western government agencies warn that Iranian state-backed actors are using WhatsApp and Telegram messages to trick targeted individuals into installing a Windows surveillance and data-stealing tool called “Chosen Brick.” The attackers build trust by impersonating known people or organizations,…
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
