A joint UK-US-Dutch advisory warns Iranian state-backed cyber actors are targeting dissidents, activists, and journalists by first contacting them on WhatsApp or Telegram and building trust. The attackers then persuade victims to open a malicious file disguised as legitimate software (or even MRI results), infecting Windows devices with CHOSEN BRICK to steal messages, emails, and other sensitive information.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The campaign begins on WhatsApp or Telegram, where someone who looks familiar starts a friendly chat. They build rapport, then drop a file: 'Hey, install this new Pictory video tool' or 'Telegram support needs you to run this security app.' It’s actually CHOSEN BRICK malware for Windows. Once you run it, CHOSEN BRICK dodges Microsoft Defender, sits in your registry, and can quietly grab your emails, chats, contacts, screenshots, even turn on your mic, and that data has shown up on pro-Iranian leak sites. If anyone on WhatsApp or Telegram sends you software or MRI results to open on your PC, stop and verify them through a separate channel before you click.
UK, US, and Dutch agencies warned that Iranian state-linked actors used social messaging apps to build trust with dissidents, journalists, and activists before sending disguised files that install Windows malware. The attackers often impersonated someone the target already knows or “technical…
Western government agencies warn that Iranian state-backed actors are using WhatsApp and Telegram messages to trick targeted individuals into installing a Windows surveillance and data-stealing tool called “Chosen Brick.” The attackers build trust by impersonating known people or organizations,…
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
