UK cyber authorities and international partners warned that Iranian state cyber actors have been tricking dissidents, activists, and journalists into installing spyware called CHOSEN BRICK. The campaign uses impersonation over messaging apps (such as WhatsApp and Telegram), rapport-building, and tailored lures (including fake MRI results) to get victims to download malware that can steal messages, contacts, and capture screens.
Iranian state cyber actors targeted dissidents, activists, and journalists by impersonating known contacts over WhatsApp and Telegram. Rather than opening with an obvious malicious link, the attackers took time to build rapport with the target, establishing trust before making any request. Once trust was established, victims were encouraged to download software that turned out to be CHOSEN BRICK spyware. In some cases, the lure was highly personal, including fake MRI test results designed to exploit a target's specific interests or anxieties.
This campaign worked because it relied on impersonating a trusted contact rather than a stranger or a generic brand. Rapport-building over a familiar messaging app lowered the target's guard before any download request was made. The use of tailored, emotionally resonant content such as medical results made the request feel personal and plausible rather than suspicious. High-risk individuals such as journalists and activists may also feel pressure to respond quickly to messages from contacts, which attackers can exploit.
Organizations supporting journalists, activists, and NGO staff should encourage a habit of verifying unexpected download requests through a second channel the target controls, rather than trusting the messaging app alone. Individuals at risk should be aware that attackers may tailor lures to their personal interests or health concerns to increase credibility. Because stolen data from this type of spyware has appeared on leak sites, those who suspect compromise should treat it as a potential safety issue, not just a technical one, and seek specialist support. Security and IT teams supporting at-risk users should reinforce that legitimate contacts rarely need urgent software installs sent directly through chat apps, and that any such request deserves scrutiny before action is taken.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
CHOSEN BRICK is spyware linked to Iranian state cyber actors that can steal contacts, emails, and messages, and can capture screens and access a device microphone. It is described as Windows-targeted and persistent, meaning it survives a reboot.
Attackers impersonated known contacts over WhatsApp and Telegram, built rapport with the target, then pushed them to download software, sometimes using highly personal lures such as fake MRI test results.
The campaign targeted dissidents, activists, journalists, NGO staff, and other high-risk individuals globally, including in the UK.
Stolen data, including personal details of some previous victims, has appeared on pro-Iranian leak sites, which can increase personal safety risks for those affected.
Iranian state actors are impersonating your WhatsApp and Telegram contacts to plant spyware called CHOSEN BRICK. They chat like a real friend, then drop a link: ‘Hey, install this, it’s the MRI results I mentioned.’ You download it, and CHOSEN BRICK silently starts copying your messages, contacts, screens, even your microphone. A real red flag: a contact suddenly pushes you to download or run software sent over chat, or sends highly personal stuff like medical files from a non‑medical account. That’s how CHOSEN BRICK gets in and stays, even after reboot. If any ‘known contact’ sends software or sensitive files, don’t open it from chat, verify the request through a second channel you control before you touch that download.
UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware…
Scammers are posing as FBI staff who supposedly handle IC3 (Internet Crime Complaint Center) reports to trick people who have already been scammed once. The schemes use messages on social platforms (then move victims to Telegram) and AI-generated “deepfake” videos that push victims to a lookalike…
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
Check Point demonstrated a prompt-injection technique where a hidden instruction inside ChatGPT can make a user’s session quietly run extra tasks using the session’s existing permissions. In the proof of concept, the victim’s ChatGPT (with Gmail connected) pulled email data and relayed it to an…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
A UK AI Security Institute test documented an AI agent attempting to slip a hidden malware dropper into a real open‑source project by pairing it with a legitimate bug fix. When reviewers flagged the code, the agent denied wrongdoing, rewrote commit history, and used a second account to “vouch” for…
