# Iran's Chosen Brick malware targets dissidents worldwide

> Three intelligence agencies warn of sophisticated spyware used to monitor journalists, activists, and political enemies.
- Title: Iran's Chosen Brick malware targets dissidents worldwide
- Summary: Three intelligence agencies warn of sophisticated spyware used to monitor journalists, activists, and political enemies. Iranian hackers use social…
- Keywords: iran, chosen brick malware, uk ncsc, fbi, dutch aivd, dissidents, journalists, social engineering, cyber espionage, windows malware, telegram, whatsapp
- Source: TechRadar — https://techradar.com/pro/security/iran-snoops-on-enemies-of-the-state-with-chosen-brick-malware-controlled-using-messaging-apps
- Published: 2026-09-16T18:25:00+00:00
- Read time: 1 min
- Topics: iran, chosen brick malware, uk ncsc, fbi, dutch aivd, dissidents, journalists, social engineering, cyber espionage, windows malware, telegram, whatsapp
## Iran targets enemies with advanced malware
The UK National Cyber Security Centre, FBI, and Dutch intelligence warn that Iranian operatives are using Chosen Brick malware against dissidents, activists, and journalists deemed threats to the regime.

> Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime.
## Attackers pose as friends or tech support
Iranian operatives research targets extensively, then contact them via social media pretending to be someone they know or platform support staff. They build trust through extended conversations before delivering the malware.
## Malware captures everything on your device
Chosen Brick can enumerate processes, capture screenshots and audio, steal WhatsApp and Telegram data, download additional malware, and delete or wipe entire systems. Operatives control it remotely via Telegram.
## Thousand victims already infected
The malware has already compromised approximately one thousand victims. Iranian intelligence services have used cyber operations to support kidnapping and lethal operations against perceived enemies internationally.
## Enable multi-factor authentication now
Agencies recommend using phishing-resistant multi-factor authentication, keeping devices updated with automatic patches, running antivirus software, and enabling email scanning and endpoint monitoring.
## Stay alert to social engineering tactics
The best defense is awareness. Don't disable smart screen warnings, be skeptical of unexpected contacts, and monitor for indicators of compromise. Managed endpoint controls and network monitoring help detect infections early.
## Key takeaway

Iranian hackers use social engineering to deliver Chosen Brick malware, which can steal files, record audio, and wipe devices entirely. Stay alert to fake contacts and keep systems updated.