UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware can steal messages and emails, capture audio/screens, and leak victims’ personal information online.
This campaign, linked to Iran's Ministry of Intelligence and Security, relied almost entirely on social engineering rather than technical exploits. Attackers approached targets through everyday messaging platforms including WhatsApp, Telegram, and Instagram. Instead of sending malware immediately, they spent time building rapport with victims, sometimes posing as an individual the target already knew, and other times posing as technical support from the platform itself. Once trust was established, the attacker sent a file disguised as a familiar or useful tool, such as Norton Antivirus, Telegram, the password manager KeePass, or the AI tool Pictory. In some cases, the lure was even more personal: a file presented as MRI scan results.
The effectiveness of this campaign came from patience and personalization rather than volume. Because attackers had deep knowledge of their targets, the pretexts felt plausible and the files seemed to come from a trusted source or a legitimate need. High-risk individuals like journalists and activists often receive many messages from unfamiliar contacts, which can make an unusual request blend in. Attackers also tried to steer victims toward opening files on personal devices when work devices had stronger protections, deliberately working around corporate security controls.
Organizations supporting high-risk users, including journalists, executives, and communications staff, should reinforce a few habits. Verify identity through a separate channel before opening any file sent via messaging apps, even if the sender appears to be someone known. Treat claims of "platform support" contacted through chat as suspicious, since legitimate support channels rarely operate this way. Establish clear reporting paths for requests to bypass corporate device policies, since this is a deliberate technique attackers use to reach less protected personal devices. Because this spyware can capture messages, audio, screens, and browser data from apps like WhatsApp and Telegram, awareness training should specifically address messaging-based social engineering, not just email phishing, given how central these platforms were to the deception.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They built rapport with victims over WhatsApp, Telegram, and Instagram before sending malicious files disguised as legitimate software like Norton Antivirus, Telegram, KeePass, or even MRI scan results.
The campaign targets journalists, activists, dissidents, executives, and communications professionals, particularly those who use WhatsApp or Telegram for work.
The spyware can steal emails and messages, capture screens and audio, and exfiltrate WhatsApp and Telegram data from browsers.
Attackers sometimes push victims to open files on personal devices specifically to bypass corporate security controls that would otherwise block the malware.
Imagine this WhatsApp: “Hi, this is support from your social media platform, install this tool to fix an issue on your account.” Iran‑linked spyware campaigns do exactly this: they chat on WhatsApp or Telegram, build rapport, then drop a Windows file pretending to be Norton, Telegram, KeePass, Pictory, even MRI scan results. The moment you open it, their spyware can quietly copy your emails, chats, WhatsApp and Telegram data, even record your screen and audio, on both work and personal devices. Here’s the move: if anyone on WhatsApp or Telegram sends you software or “MRI results” and wants you to open it, especially on your personal device, don’t. Stop, verify through a trusted channel, and report it.
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
Western government agencies warn that Iranian state-backed actors are using WhatsApp and Telegram messages to trick targeted individuals into installing a Windows surveillance and data-stealing tool called “Chosen Brick.” The attackers build trust by impersonating known people or organizations,…
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
UK cyber authorities and international partners warned that Iranian state cyber actors have been tricking dissidents, activists, and journalists into installing spyware called CHOSEN BRICK. The campaign uses impersonation over messaging apps (such as WhatsApp and Telegram), rapport-building, and…
