Reported by 2 outlets
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
gbhackers.com · 27d ago · September 16th, 2026
Iranian state-linked cyber actors are using fake AI applications, antivirus tools and even fabricated MRI scan results to deliver CHOSEN BRICK, a Windows-focused spyware family designed to surveil dissidents, activists and journalists. A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI and the Netherlands’ AIVD warns that the campaign has targeted […] The post Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
CHOSEN BRICK Malware Lets Iranian State Hackers Steal Emails, WhatsApp and Telegram Data
cyberpress.org · 27d ago · September 16th, 2026
Iranian state-linked hackers are using a Windows malware family called CHOSEN BRICK to spy on dissidents, activists, journalists, and other individuals viewed as threats to the Iranian regime. The malware has been active since at least 2025 and has targeted people in the UK, United States, Netherlands, and other countries. A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI , and the Netherlands’ AIVD intelligence service said CHOSEN BRICK can steal emails, social-media messages, contacts, screenshots, audio recordings, and system information. The collected data could help operators track a victim’s communications, movements, and daily activities. The warning comes amid continued concerns that Iran uses cyber operations to identify, monitor, intimidate, and harass critics abroad. In several previous cases, personal information stolen from victims was published on pro-Iranian leak websites, creating additional privacy and personal-safety risks. CHOSEN BRICK Steals Messaging Data The operators begin their attacks through WhatsApp , Telegram, and other social-messaging platforms. They spend time building trust with targets, often posing as someone the victim already knows or as technical-support staff from a messaging service. The attackers then persuade targets to download and open a file that appears legitimate. Observed lures have impersonated applications including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass.