Antivirus that isn't

Iran has allegedly been shipping malicious apps dressed up as Norton Antivirus and the KeePass password manager, using them to slip Windows spyware onto victims' machines.

FBI and UK sound off

On Tuesday the FBI joined the UK's NCSC in a public alert, tracing the campaign to Iranian state-sponsored hackers targeting dissidents, activists, and journalists.

The fake IT guy

Attackers open with friendship, not malware. They chat over messaging apps posing as IT customer support, or impersonate someone the target already knows, then ask them to open a file.

“The actor uses this rapport with the target to convince them to download and open a file that appears authentic to the target”

Bait beyond antivirus

The lures stretch across AI video tools Pictory and RunwayML, plus Telegram and Adobe Flash Player. One campaign used a fake MRI test result to hook its target.

Chosen Brick hunts desktops

The payload, named Chosen Brick, goes after PCs rather than phones. Every observed sample targeted Windows only, and it slides past the built-in Windows Defender.

“In all observed instances, the malware has been exclusively targeted at the Windows operating system”

It watches and listens

Chosen Brick grabs screen content, records microphone audio, pulls message data out of browsers, and downloads more malware components once it's inside.

Surveillance becomes harassment

Screenshots stolen from victims have been published to embarrass them, and personal details have surfaced on pro-Iranian leak sites, raising real physical risk for people already under pressure.

“The personal details of some previous victims of CHOSEN BRICK have appeared on pro-Iranian leak sites”