The United Kingdom, alongside its allies, has issued a stark warning to individuals opposing the Iranian regime, indicating that they may be exposed to a targeted spyware campaign supported by Tehran. This advisory, released on September 15, is a collaborative effort from the National Cyber Security Centre (NCSC) of the UK, the Federal Bureau of Investigation (FBI) in the United States, and the Netherlands’ General Intelligence and Security Service (AIVD). Its primary aim is to safeguard dissidents, activists, and journalists who are critical of the Iranian government.
The advisory emphasizes a troubling reality: information obtained through the deployment of this spyware has shown up on pro-Iranian leak sites, thereby heightening the danger faced by victims in terms of their personal safety. Paul Chichester, the director of operations at NCSC, articulated the gravity of the situation, stating, “The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices.” He echoed a message of vigilance, urging those at risk to familiarize themselves with the social-engineering tactics highlighted in the advisory, and to take preventive measures based on the guidance provided.
At the heart of this malicious campaign lies a spyware named Chosen Brick, which is specifically engineered to extract sensitive information from its targets. This includes contact lists, emails, and social media messages, essentially enabling the surveillance of individuals’ movements and activities, which can lead to repression or worse outcomes. Chosen Brick employs sophisticated techniques to ensure its continued presence on infected devices, utilizing Windows registry keys to maintain its operation and adapting to evade detection by Microsoft Defender antivirus.
The spyware has several alarming functionalities: it connects to Telegram for command and control (C2), captures screen images, enumerates running processes, gathers system information, and can even harvest data from browsers across various platforms including Telegram and WhatsApp. Moreover, it has the capacity to delete files, download additional malware, or completely wipe the system clean, according to reports from the NCSC.
The distribution of Chosen Brick is executed through social engineering tactics. Cybercriminals typically develop a rapport with potential victims on social media, often by impersonating trusted contacts or masquerading as technical support personnel. They then manipulate victims into downloading seemingly legitimate applications—such as Pictory, RunwayML, Norton Antivirus, and others—or files that appear harmless.
In light of these threats, the advisory encourages organizations that suspect they may have been infected to consult their internal or external IT support services for a thorough investigation. Notably, the advisory specified that individuals should be vigilant since this threat actor is targeting personal devices as well as corporate systems. Organizations are encouraged to disseminate information regarding this risk to staff members who might be particularly vulnerable, assisting them in examining their personal devices for potential compromises.
One silver lining identified by the NCSC is that the spyware interfaces with numerous legitimate web services, meaning that signs of its activity may be captured in corporate logs via DNS and web proxy services. This could offer additional opportunities for detection and mitigation.
To further shield themselves from these threats, the advisory outlines several best practice mitigations for targets, including:
– Following the NCSC’s guidelines on staying secure online, which emphasize the importance of avoiding dubious download links and attachments.
– Enabling automatic updates for operating systems and software to ensure they are always up-to-date.
– Utilizing reputable antivirus software that is regularly updated to combat emerging threats.
– Not disregarding smart screen warnings when downloading files.
Network administrators are also urged to consider implementing phishing-resistant Multi-Factor Authentication (MFA) and managing device fleets through antivirus software, application allowlisting, and other protective measures. Additionally, establishing robust endpoint and network monitoring mechanisms can aid in early detection of suspicious activities.
The NCSC disclosed that this particular campaign has been in operation since at least 2025, highlighting the persistent threat of Iranian cyber activities aimed at silencing dissent and infringing on the rights of activists, journalists, and dissidents. Organizations and individuals alike must remain vigilant and proactive in facing these evolving cyber threats to ensure their safety and security in an increasingly hostile digital landscape.