Three Western governments have issued a joint warning regarding Iranian state-sponsored cyber actors deploying surveillance and data-stealing malware, dubbed "Chosen Brick," on Windows machines. The campaign, active since at least 2025, targets individuals perceived as threats to the Iranian regime, including dissidents, activists, and journalists.
The attacks typically originate through social messaging applications like WhatsApp and Telegram. Attackers conduct extensive research on their targets, gathering information on individuals, their contacts, and relevant organizations to craft highly believable social engineering lures. They then establish rapport with the victim before convincing them to download and open a malicious file disguised as a legitimate application.
Confirmed examples of applications mimicked by the malicious files include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. Once executed, Chosen Brick operates stealthily, surviving reboots and adding exclusions to Microsoft Defender antivirus to evade detection. The malware establishes command-and-control (C2) communications via Telegram, utilizing a victim-specific bot.
Chosen Brick achieves persistence on infected Windows devices by modifying the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`. While lateral movement across networks has not yet been observed, the advisory notes its technical feasibility. The malware can download additional payloads, enumerate running processes and system information, capture screen and audio content, steal emails, and exfiltrate Telegram and WhatsApp data from web browsers. It also possesses the capability to wipe the entire computer system.
The FBI, UK National Cyber Security Centre, and the Netherlands’ General Intelligence and Security Service (AIVD) issued the alert, emphasizing that Iran likely uses such cyber activities to repress individuals deemed a threat. The advisory also highlighted that Iranian intelligence services have previously plotted kidnappings or lethal operations against perceived enemies of the regime internationally.
Organizations are advised to contact their IT providers if they suspect Chosen Brick has been executed on their systems. Given that the threat targets personal devices in addition to corporate ones, organizations are encouraged to inform staff who might be targeted and support them in checking their personal devices.
This latest alert follows a series of cyberattacks on water and energy infrastructure that researchers and media reports have linked to Iran. In August, the US Cybersecurity and Infrastructure Security Agency (CISA) disclosed that July cyberattacks disrupted over 100 internet-exposed water systems across 12 US states. Around the same time, a suspected Iran-linked cyberattack also reportedly shut down a small power plant in the UK. Additionally, five US agencies warned in August that attackers are using AI-generated exploitation scripts to breach internet-exposed Siemens S7 Series programmable logic controllers (PLCs) in critical facilities, including water, manufacturing, and energy sectors.
