Reported by 4 outlets

Timeline

1. original reporting

   🤖 Iranian state-linked hackers deploy Windows malware CHOSEN BRICK against dissidents, activists and journalists worldwide, per government w

   www.bleepingcomputer.com · 27d ago · September 16th, 2026

   🤖 Iranian state-linked hackers deploy Windows malware CHOSEN BRICK against dissidents, activists and journalists worldwide, per government w

   via Mastodon https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/

2. update from threat-intelligence.redeyesecurity.com

   Iran's MOIS is running spyware command-and-control through Telegram, with a dedicated bot provisioned for each victim. Why it matters: per-v

   threat-intelligence.redeyesecurity.com · 27d ago · September 16th, 2026

   Iran's MOIS is running spyware command-and-control through Telegram, with a dedicated bot provisioned for each victim. Why it matters: per-v

   via Mastodon https://threat-intelligence.redeyesecurity.com/blog/iran-mois-heavygram-chosen-brick-telegram-malware-2026

3. update from bleepingcomputer.com

   Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

   bleepingcomputer.com · 27d ago · September 16th, 2026

   Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. The malware features data theft and espionage capabilities that collect email, Telegram, and WhatsApp communications, take screenshots, and record audio. The threat actor primarily targeted individuals in the U.S., U.K., and the Netherlands, whose cybersecurity agencies published a joint advisory with the FBI. A typical attack begins with social engineering messages impersonating trusted contacts or technical support agents, sent to targets via WhatsApp or Telegram. The threat actor tricks victims into opening malicious files disguised as legitimate applications (e.g., Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass), often suggesting they launch them on personal devices to bypass corporate security blocks. Depending on the pretext used, the hackers sometimes used even medical-related lures, the agencies found. MRI scan document used as lure Source: NCSC The apps display a convincing interface that matches the lure, while silently installing CHOSEN BRICK in the background and securing persistence through Windows Registry Run keys. The malware adds Microsoft Defender exclusions to evade detection and connects to a unique Telegram bot that matches the victim’s ID and provides command-and-control (C2). Once launched, CHOSEN BRICK can perform the following actions: Collect sys

4. mentioned by www.bleepingcomputer.com

   🤖 CHOSEN BRICK: Iranian state-linked Windows malware targets dissidents, activists and journalists in the US, UK, Netherlands per a joint FB

   www.bleepingcomputer.com · 27d ago · September 17th, 2026

5. update from tugatech.com.pt

   Iranian malware CHOSEN BRICK spies on activists through fake medical exams

   tugatech.com.pt · 26d ago · September 17th, 2026

   The alert was issued in a joint statement by the UK National Cyber Security Centre (NCSC), in collaboration with the FBI and Dutch authorities. The attack begins with social engineering schemes shared on platforms like Telegram and WhatsApp. Attackers impersonate trusted contacts or technical support agents to trick users into opening malicious files. These files are presented as legitimate applications including Norton Antivirus, Adobe Flash Player, or KeePass, and often appear under the pretext of medical results such as MRI documents. To avoid detection, the program adds security exceptions to Microsoft Defender. Control of the infection is handled through a single Telegram bot associated with the victim's identifier. From that point, the attackers gain full access to the device. The threat can capture the screen, record audio through the microphone, and extract email content as well as WhatsApp and Telegram data. The malicious code downloads additional payloads to the C:\Windows\SysWOW64 folder and can delete files or completely wipe the host system. Exfiltrated data is sent to attackers through cloud services such as VultrObjects and StorjShare, or via Telegram itself. Recent variants use SOCKS5 proxies to hide network traffic. According to the security agencies' report, stolen data frequently ends up on leak sites associated with pro-Iranian groups, serving as a harassment method that increases physical risk to dissidents abroad. The document notes that Iranian intelligence services have already planned kidnappings and lethal operations internationally against individuals considered enemies of the regime. Source: https://tugatech.com.pt/t91177-malware-iraniano-chosen-brick-espia-ativistas-atraves-de-falsos-exames-medicos

6. update from securityaffairs.com

   CHOSEN BRICK, Iran surveillance malware targets dissidents worldwide

   securityaffairs.com · 26d ago · September 17th, 2026

   After execution, CHOSEN BRICK installs silently, maintaining persistence through Windows Registry keys and adding Defender exclusions. Iranian intelligence has been linked to international kidnapping and lethal operations against dissidents. Source: https://securityaffairs.com/199217/malware/chosen-brick-irans-surveillance-malware.html