Agencies Warn of Iranian Spyware Campaign Using Fake MRI Lures to Target Dissidents
Summary
British, U.S., and Dutch agencies warn that Iranian state-sponsored hackers use CHOSEN BRICK spyware, delivered through tailored messaging lures, to surveil people viewed as threats to the regime and potentially increase their physical risk.
Key points
- The joint warning says victims in the UK, U.S., and Netherlands have been targeted since at least 2025.
- Operators build trust through WhatsApp or Telegram, often impersonating known contacts or technical support, before sending tailored malicious files, including a fake MRI scan.
- CHOSEN BRICK targets Windows devices, collects contacts, emails, messages and screen content, and can activate the microphone.
- The malware persists across reboots, adds Microsoft Defender exclusions, and uses Telegram for command and control and file transfers.
- Agencies warn that stolen personal information can enable surveillance and harassment, and may increase victims' physical risk.
- The NCSC did not name a specific Iranian government entity behind this campaign; the FBI has separately attributed similar activity to actors operating on behalf of Iran's MOIS.
Article Details
- Event Type
- Joint cybersecurity warning about Iranian state-sponsored hackers using CHOSEN BRICK spyware to target people perceived as threats to the Iranian regime.
- Impact
- The spyware can steal contacts, emails, social media messages, files, screenshots, and microphone audio, enabling surveillance and harassment and potentially increasing victims’ risk of physical intimidation. The warning covers victims in the United Kingdom, the United States, and the Netherlands dating back to at least 2025.
MITRE ATT&CK
T1056 · Input CaptureCHOSEN BRICK can capture audio by switching on the victim's microphone.T1113 · Screen CaptureCHOSEN BRICK can capture screen content.T1547.001 · Registry Run Keys / Startup FolderThe malware survives reboot by relaunching at login.T1562.001 · Disable or Modify ToolsThe malware adds exclusions to Microsoft Defender to reduce the chance of detection.T1566 · PhishingOperators reportedly use social engineering and fake lures to deliver malicious files to targets.
People
Threat Actors
HandalaOnline persona the FBI assesses is operated by MOIS; the bureau linked it to a July 2025 hack-and-leak operation.Homeland JusticeGroup described as connected to Handala Hack.MOISIranian Ministry of Intelligence and Security; the FBI attributed related activity to actors operating on its behalf and assesses it operates Handala Hack.
Malware
Products
Adobe Flash PlayerAttackers use fake files and impersonated software like Adobe Flash Player and KeePass.KeePassAttackers use fake files and impersonated software like Adobe Flash Player and KeePass.Microsoft Defender Antimalware PlatformIt also adds exclusions to Microsoft Defender to reduce the chance of it being detected.Microsoft WindowsThe CHOSEN BRICK malware itself only works on Windows systems and is designed to survive devices being rebooted by relaunching at login.Norton AntivirusAlongside the MRI scan, the attackers have impersonated legitimate products including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass.PictoryAlongside the MRI scan, the attackers have impersonated legitimate products including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass.RunwayMLAlongside the MRI scan, the attackers have impersonated legitimate products including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass.TelegramVictims are targeted through WhatsApp and Telegram social engineering campaigns.WhatsAppVictims are targeted through WhatsApp and Telegram social engineering campaigns.
Tools
Countries
IranAccording to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such asNetherlandsThe alert was issued jointly by the NCSC, the FBI in the United States, and the Netherlands’ General Intelligence and Security Service (AIVD).United KingdomAccording to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such asUnited StatesThe alert was issued jointly by the NCSC, the FBI in the United States, and the Netherlands’ General Intelligence and Security Service (AIVD).