UK, US, and Netherlands Issue Joint Advisory Exposing Iranian 'CHOSEN BRICK' Spyware

A joint cybersecurity advisory issued by Britain’s National Cyber Security Centre (NCSC), the United States Federal Bureau of Investigation (FBI), and the Netherlands’ General Intelligence and Security Service (AIVD) has exposed a sophisticated Iranian surveillance operation. The report detailed how state-linked threat actors are utilizing a specialized spyware family known as 'CHOSEN BRICK' to conduct targeted espionage against political dissidents, human rights activists, and journalists worldwide.

According to the advisory, the attackers employ social engineering and spear-phishing tactics on popular messaging platforms, including WhatsApp and Telegram, to build rapport with targets before delivering malicious payloads disguised as legitimate software or documents. Once installed on Microsoft Windows systems, CHOSEN BRICK establishes persistent access that survives system reboots. It enables operators to harvest contact lists, steal private emails, capture real-time screen content, and surreptitiously record audio through device microphones.

Intelligence officials noted that stolen information has repeatedly surfaced on pro-regime leak websites, exposing victims to severe personal security risks. Authorities urged high-risk individuals, civil society organizations, and media professionals to implement strict digital hygiene, enforce multi-factor authentication, and verify the identity of unknown contacts on encrypted messaging platforms.