Iranian spyware campaign targets dissidents, UK says

What's happened

British National Cyber Security Centre warns that Iranian state-linked actors used CHOSEN BRICK spyware to steal emails, messages and device data via spear-phishing on WhatsApp and Telegram. The campaign has affected victims globally; the FBI and international partners say MOIS is behind the operation. Authorities urge vigilance and technical mitigations.

What's behind the headline?

Critical analysis

• The headline oversimplifies the threat by focusing on a single actor; the broader landscape includes multiple Iranian cyber operations and allied groups.
• What behind the story is a sustained push by Iran to surveil critics abroad, leveraging trusted contacts to lower victims’ guard.
• The timing aligns with a string of alerts across Western allies, suggesting a coordinated diplomatic and technical response.
• Foreseeable outcomes include stricter export controls, increased private-sector cyber hygiene, and potential counter-operations against the Handala Hack persona.
• For readers, expect practical steps: verify contacts, avoid downloading files from informal channels, and adopt MFA and device-level protections.

How we got here

The advisory follows a March 2026 warning and comes as the UK cites ongoing state-backed cyber operations aimed at dissidents. NCSC, FBI, and Netherlands’ AIVD are coordinating to track and counter the threat, using social-engineering lures such as fake MRI results to deploy malware.

Our analysis

The Independent reports on NCSC and FBI advisories; Arab News and The Times of Israel summarize the same campaign and emphasise the role of MOIS. Authorities attribute operational details to official statements from NCSC Director of Operations Paul Chichester, with corroboration from the FBI advisory and partners like the Netherlands’ AIVD.

Go deeper

• What new evidence has emerged about MOIS?
• How should individuals protect their devices now?
• Are Western allies coordinating more cyber operations in response?

More on these topics

• Netherlands - Country in Europe

  The Netherlands, informally Holland, is a country primarily located in Western Europe and partly in the Caribbean, forming the largest constituent country of the Kingdom of the Netherlands.

• Iran (Islamic Republic of Iran) - Country in the Middle East

  Iran, also called Persia, and officially the Islamic Republic of Iran, is a country in Western Asia. It is bordered to the northwest by Armenia and Azerbaijan, to the north by the Caspian Sea, to the northeast by Turkmenistan, to the east by Afghanistan a

• National Cyber Security Centre - Wikimedia disambiguation page

  National Cyber Security Centre, National Cyber Security Center, or National Cybersecurity Center may refer to:

• Michigan - US State

  Michigan is a state in the Great Lakes and Midwestern regions of the United States. Its name comes from the Ojibwe word mishigami, meaning "large water" or "large lake".

• Kash Patel - Director of the Federal Bureau of Investigation

  Kashyap Pramod Patel (born February 25, 1980) is an American lawyer serving since 2025 as the director of the Federal Bureau of Investigation. Patel also served as acting director of the Bureau of Alcohol, Tobacco, Firearms and Explosives from February...