UK, U.S., and Dutch agencies warn Iranian MOIS-linked spies used CHOSEN BRICK spyware and fake MRI scan lures against dissidents

British, American, and Dutch agencies warned that Iranian state-backed hackers used tailored social-engineering messages and fake files, including bogus MRI scan results, to infect targets with CHOSEN BRICK spyware. The campaign has affected people in the UK, U.S., and Netherlands since at least 2025 and focuses on dissidents, activists, and journalists. The Windows malware steals contacts, email and social-media messages, captures screenshots, can activate the microphone, adds Microsoft Defender exclusions, persists after reboot, and uses per-victim Telegram bots plus cloud services for command and control and exfiltration.

Why it matters: This is not just cyber espionage: the stolen data can help Iranian intelligence map a victim’s daily life and raise physical risks such as harassment, kidnapping, or worse. Organizations with at-risk staff should urgently share the advisory, scrutinize WhatsApp and Telegram contact attempts, and check personal and work Windows devices for compromise.

Sources

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Bill Toulas 2026.09.16 97% relevant

This article is a direct report on the same joint U.K.-U.S.-Netherlands-FBI advisory, adding operational detail on the Windows CHOSEN BRICK malware’s behavior, including Registry Run-key persistence, Microsoft Defender exclusions, Telegram bot-based command and control, theft of email and Telegram/WhatsApp browser data, and exfiltration via Telegram, VultrObjects, and StorjShare.

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Eduard Kovacs 2026.09.16 97% relevant

This is the same underlying joint US-UK-Dutch government warning about the Iranian CHOSEN BRICK malware campaign; it adds details on Telegram-based command-and-control, use of personal devices to bypass enterprise protections, Microsoft Defender exclusions, registry Run-key persistence, and destructive wiping capability.

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

2026.09.15 96% relevant

This article is a direct follow-on covering the same joint government warning and adds detail that Chosen Brick has been observed only on Windows, uses Telegram bots for command-and-control, impersonates apps including Pictory, RunwayML, Norton, Telegram, Flash Player, and KeePass, adds Microsoft Defender exclusions, and can steal emails, contacts, messages, screen and audio data or wipe systems.

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’

2026.09.15 100% relevant

This article establishes a distinct new story by naming the CHOSEN BRICK spyware campaign, its specific fake MRI-scan lure, the joint agency attribution, the cross-border victim set, and the MOIS-linked repression context.