GoKawiilIranian state hackers deploy CHOSEN BRICK malware against journalists and activists
Cybersecurity agencies from the U.S., U.K. and Netherlands, alongside the FBI, issued a joint advisory exposing an Iranian state-linked campaign using Windows malware called CHOSEN BRICK to spy on dissidents, journalists and activists. Attackers pose as trusted contacts or tech support over WhatsApp and Telegram, luring victims into launching disguised fake apps that secretly install the spyware and evade Windows Defender.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign shows how authoritarian states use everyday messaging platforms and social engineering, rather than sophisticated exploits, to surveil critics abroad. Its capabilities—stealing messages, recording audio, capturing screenshots, and even wiping systems—pose serious risks to the safety of journalists and activists who may be physically endangered by exposure.
- CHOSEN BRICK spreads via fake apps and social engineering on WhatsApp/Telegram, not software exploits.
- The malware exfiltrates stolen data through Telegram bots and cloud storage services like VultrObjects and StorjShare.
- Target groups include dissidents and journalists in the US, UK, and Netherlands, prompting a joint government advisory.
YubiKey 5 NFC Security Key — Given how this campaign relies on social engineering and tricking targets into installing malicious apps, adding hardware-backed multi-factor authentication is a smart defense layer. A YubiKey lets journalists and activists secure their email, Telegram, and other accounts against credential theft even if a device gets compromised. It's a simple, tangible step toward better personal security hygiene.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-16
Published there as: “Iranian hackers use CHOSEN BRICK Windows malware to spy on targets”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.