CHOSEN BRICK
Windows spyware used by Iranian state actors against dissidents, activists and journalists.
On 15 September 2026 the UK's NCSC, the FBI and the Dutch AIVD jointly exposed CHOSEN BRICK, Windows spyware they say Iranian state actors turn on dissidents, activists and journalists, including targets living in the UK.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How does Iranian spyware reach dissidents through WhatsApp and Telegram?
Timeline for CHOSEN BRICK
UK, US and Dutch expose Iranian spyware
Cybersecurity: Threats and DefencesBackground
CHOSEN BRICK is Windows spyware that three Western agencies attribute to Iranian state actors. The UK National Cyber Security Centre (NCSC), the FBI and the Dutch General Intelligence and Security Service (AIVD) named it in a joint advisory on 15 September 2026, with the FBI publishing separate technical analysis. The targets are dissidents, activists and journalists worldwide, some of them in the UK.
The advisory describes a patient approach. Operators pose as contacts on WhatsApp and Telegram, build rapport over time, then send a tailored lure such as fake MRI scan results. Once installed, the spyware collects contacts, email and messages, captures the screen, can switch on the microphone and survives a reboot.
The NCSC says stolen material has surfaced on pro-Iranian leak sites, which can put victims' physical safety at risk. The exposure follows a March 2026 warning from the NCSC and AIVD that Iran's Islamic Revolutionary Guard Corps was among state actors posing as contacts to take over messaging accounts.
