Iranian CHOSEN BRICK Malware Targeting Global Dissidents

Iranian state cyber actors have been identified targeting dissidents, journalists, and activists in the UK, US, and the Netherlands since at least 2025. This activity is frequently used to support regime repression, with stolen personal data occasionally appearing on pro-Iranian leak sites, potentially increasing the physical risk to victims. The joint advisory from the NCSC, FBI, and AIVD highlights a shift where actors target personal devices to bypass corporate security controls.

The attack chain relies heavily on social engineering via WhatsApp and Telegram, where actors impersonate trusted contacts or technical support. Victims are coerced into downloading malicious lures disguised as legitimate software (e.g., KeePass, Adobe Flash) or medical documents. Once executed, the primary malware, CHOSEN BRICK, establishes persistence, evades Microsoft Defender, and exfiltrates sensitive communications and audio recordings to a unique Telegram bot.

This threat is considered high-priority for individuals and organizations associated with activism or journalism related to Iran. The ability of the malware to download additional payloads and perform system wipes indicates a flexible platform for both long-term espionage and destructive operations.