Iran Uses WhatsApp Lures to Drop Chosen Brick Malware

How the Attack Worked

The campaign relies on messaging apps that people already trust for personal conversations. Attackers reach out via WhatsApp or Telegram while impersonating a contact or organization the target knows. Before sending that first message, the actors research the target, their contacts, and relevant industry organizations so the conversation feels believable and familiar rather than suspicious.

Once rapport is established, the attacker persuades the victim to download and open a file disguised as a legitimate application. The malicious files have been made to resemble tools like Norton Antivirus, Telegram, Adobe Flash Player, KeePass, Pictory, and RunwayML. When the file is opened, the Chosen Brick malware executes quietly and is built to survive a device reboot, giving the attacker continued access.

Why It Succeeded

This approach succeeds because it exploits the trust that already exists between the victim and their real-world contacts. Because the request arrives through a familiar chat thread rather than an unsolicited email, it bypasses the skepticism people typically apply to unknown senders. The extensive research behind each message also means the pretext can reference real people, organizations, or details that make the lure feel personal and credible rather than generic.

The malware itself is also built for stealth. Chosen Brick has been observed infecting Windows systems, stealing contacts, emails, and social media messages, and using Telegram bots for command-and-control. It attempts to evade detection by adding exclusions to Microsoft Defender, reducing the chance that security tools flag the activity.

What to Watch For

• A chat message from a known contact suddenly recommending an app or sending an installer file directly
• Software delivered through a chat conversation instead of an official app store or vendor website
• A period of friendly, rapport-building conversation that precedes a request to install something
• Requests to open a file quickly after that conversation has built trust

Building Resistance

Organizations supporting at-risk staff, including journalists, activists, and traveling executives, should treat any chat-based software install request as high risk. Staff should be trained to verify such requests through a separate, trusted channel and to only download applications from official sources rather than files shared in a chat.

Because this activity targets personal devices as well as corporate ones, organizations should extend awareness guidance beyond the corporate network and support staff in checking their personal Windows computers too. Recognizing grooming behavior, where an attacker builds familiarity before making an ask, is a key part of resisting this kind of social engineering.

How does the Chosen Brick attack start?

It begins with a WhatsApp or Telegram message that appears to come from someone the victim already knows and trusts, followed by a request to install a file disguised as legitimate software.

What software does the malicious file pretend to be?

The malicious files have been disguised as legitimate applications including Norton Antivirus, Telegram, Adobe Flash Player, KeePass, Pictory, and RunwayML.

Who is at risk from this campaign?

Journalists, activists, dissidents, executives, and other staff with public-facing or sensitive roles are the primary targets, and personal Windows devices are affected as well as corporate ones.

What can Chosen Brick do once installed?

It has been observed stealing contacts, emails, and social media messages, and it uses Telegram bots for command-and-control while attempting to evade detection by adding Microsoft Defender exclusions.