US, UK Agencies Detail Iranian Malware Campaign Targeting Dissidents 

A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere. 

The advisory centered on a malware family called Chosen Brick, which has been used since at least 2025. This malware has enabled Iranian state actors to collect information about victim’s contacts, emails and social media messages as well as other invasive functionalities (enabling the device’s microphone to capture audio content, capture screen content, capture Telegram and Whatsapp data, and more). 

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” according to the advisory by the FBI, UK National Cyber Security Centre, and Dutch Intelligence service. “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

The campaign has relied heavily on social engineering. Iranian operators would research targets and establish rapport with them through messaging platforms like Telegram and WhatsApp. In some cases they impersonated someone the victim knew, or technical support. They would then persuade the target to open a malicious file disguised as legitimate software. 

“These have been in the form of applications appearing to be legitimate applications such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass,” according to the advisory. “In other instances, they have been files appearing to be MRI scan results.”

In some cases, the threat actor would first initiate contact through the target’s work device – and if that failed (due to the risk of potential detection), they would then ask the victim to open the file on their personal devices in an attempt to evade corporate security controls. 

After installation, the Chosen Brick malware would establish persistence through the Windows Run registry key and add exclusions to Microsoft Defender. Chosen Brick also uses Telegram bots for command-and-control, with a separate bot ID for each victim, according to the FBI.

Chosen Brick’s capabilities are extensive and include:

• Enumerating processes and system information
• Capturing screenshots and microphone audio
• Stealing email and browser-based Telegram/WhatsApp data
• Downloading additional malware, deleting files and potentially wiping systems

“The personal details of some previous victims of Chosen Brick have appeared on pro-Iranian leak sites, potentially increasing the risk to the personal safety of those affected,” according to the advisory.