UK NCSC, FBI, and Dutch AIVD warn Iran is using Chosen Brick malware against dissidents and journalists Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitor
<![CDATA[ <article> <ul><li><strong>UK NCSC, FBI, and Dutch AIVD warn Iran is using </strong><em><strong>Chosen Brick</strong></em><strong> malware against dissidents and journalists</strong></li><li><strong>Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely</strong></li><li><strong>Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitoring</strong></li></ul><p>Iranian hackers are targeting “enemies of the state”, both local and foreign, with advanced malware capable of spying on the victims and stealing their sensitive files, experts have warned.</p><p>This is according to a new security advisory, published jointly by the UK National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service (AIVD), which noted how Iranian operatives would first do extensive research into their victims - dissidents, activists, and journalists - deemed a risk to the regime. </p><p>After learning as much about their targets as possible, they reach out via social media, either as someone the victims know, or as technical support for the platform they’re currently using, engaging in extended conversation until the victim lowers their guard. At one point, the attackers will try to share a piece of <a href="https://www.techradar.com/best/best-malware-removal" target="_blank">malware</a> with the victims, tracked as Chosen Brick.</p><h2 id="a-thousand-victims">A thousand victims</h2><p>This malware, designed primarily for the Windows platform, has a long list of capabilities, including enumerating running processes and system information, capturing screen content, enabling the microphone to capture audio content, capturing a copy of Telegram and WhatsApp data from web browsers, downloading additional files and malware, deleting files, stealing email content, and ultimately - wiping the entire computer system. The operatives communicate with the malware using Telegram, it was said.</p><p>“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the three agencies said in the report. “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”</p><p>In the advisory, the three agencies said the best defense is to simply be more aware of social engineering. However, there are also a few technical mitigations that can help, including following NCSC advice on staying safe online, keeping all devices up-to-date (ideally through automatic updates), using antivirus software, and not disabling smart screen warnings on file downloads. </p><p>Finally, it would be wise to enable phishing-resistant MFA, make sure devices are managed with appropriate controls, turn on email scanning, deploy endpoint and network monitoring, and conduct a search for the IoCs. </p><p><em>Via </em><a href="https://www.theregister.com/security/2026/09/15/iranian-spies-hit-windows-machines-with-chosen-brick-data-stealing-malware/5296646" target="_blank" rel="nofollow"><em>The Register</em></a></p> </article> ]]>
