Iranian cyber campaign targets dissidents, UK says

What's happened

Western intelligence agencies warn that Iran's state-linked hackers have used CHOSEN BRICK spyware to steal emails, messages and device data via spear-phishing on WhatsApp and Telegram, with victims linked to dissidents and activists. The advisories from the FBI, NCSC and AIVD say the operation has been active since Autumn 2023, with further developments this year.

What's behind the headline?

Analysis

• Iran has pursued a persistent, cross-border cyber operation targeting dissidents, leveraging social engineering and trusted contacts to deploy CHOSEN BRICK.
• Western partners coordinate on public advisories to deter victims and harden defenses; the latest guidance updates a March warning and underscores ongoing risk to personal and organizational data.
• The operation’s use of fabricated documents (e.g., MRI results) and tailored impersonation raises questions about how future attacks might adapt to new targets.
• Readers should assess their own security practices, especially around social-engineering schemes and scrutiny of messages from unfamiliar contacts.
• The ambition appears to be reputational harm and intelligence collection that could have broader political or economic repercussions if extended to critical infrastructure or corporate networks.

How we got here

The advisories come after repeated warnings about Iran's efforts to repress critics abroad. Hands-on cyber incidents have included an attack on Stryker in March and the publication of Kash Patel’s emails, linked to a broader campaign that has targeted a range of individuals across several countries.

Our analysis

- Al Jazeera reports that Western agencies issued coordinated warnings about Iran using CHOSEN BRICK spyware for spear-phishing on WhatsApp and Telegram. - Independent notes the NCSC, FBI and Netherlands’ AIVD caution that MOIS is using the malware to collect data and inflict reputational harm. - Arab News and The Times of Israel add details on the malware’s capabilities and the use of fake documents for luring victims.

Go deeper

• What steps should individuals take to protect themselves?
• Which sectors are most at risk next?
• How might this affect international cyber policy?

More on these topics

• Iran (Islamic Republic of Iran) - Country in the Middle East

  Iran, also called Persia, and officially the Islamic Republic of Iran, is a country in Western Asia. It is bordered to the northwest by Armenia and Azerbaijan, to the north by the Caspian Sea, to the northeast by Turkmenistan, to the east by Afghanistan a

• National Cyber Security Centre - Wikimedia disambiguation page

  National Cyber Security Centre, National Cyber Security Center, or National Cybersecurity Center may refer to:

• Netherlands - Country in Europe

  The Netherlands, informally Holland, is a country primarily located in Western Europe and partly in the Caribbean, forming the largest constituent country of the Kingdom of the Netherlands.

• Michigan - US State

  Michigan is a state in the Great Lakes and Midwestern regions of the United States. Its name comes from the Ojibwe word mishigami, meaning "large water" or "large lake".

• Kash Patel - Director of the Federal Bureau of Investigation

  Kashyap Pramod Patel (born February 25, 1980) is an American lawyer serving since 2025 as the director of the Federal Bureau of Investigation. Patel also served as acting director of the Bureau of Alcohol, Tobacco, Firearms and Explosives from February...

• United Kingdom - Country in Europe

  The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom or Britain, is a sovereign country located off the north­western coast of the European mainland.

• United States - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.