Iranian spies hit Windows machines with Chosen Brick data-stealing malware

Three Western governments have issued a warning regarding Iranian state cyber actors targeting individuals through social messaging apps like WhatsApp and Telegram. These actors deploy surveillance and data-stealing malware, known as Chosen Brick, specifically targeting Windows systems. Since at least 2025, Iran has used this malware to infiltrate individuals' devices, stealing contacts, emails, and social media messages to track people's movements.

The FBI, UK National Cyber Security Centre, and the Netherlands’ General Intelligence and Security Service (AIVD) reported that Iran likely employs cyber activities to suppress individuals deemed threats to the regime, including dissidents, activists, and journalists. Some Iranian intelligence services have even planned kidnappings or lethal operations against perceived enemies of the regime internationally.

The attacks typically begin with seemingly trustworthy messages from known contacts, allowing the attackers to conduct extensive research on the target, their contacts, and relevant industry organizations. Once rapport is established, the attackers convince the victim to download and open a file that appears legitimate, such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass.

Upon opening the file, the malware executes without the victim's knowledge, survives reboots, and connects to Telegram for command-and-control (C2) communications. Chosen Brick also evades detection by adding exclusions to Microsoft Defender antivirus and establishes persistence on infected devices. The malware can download additional malicious software, set up persistence for new payloads, enumerate running processes and system information, capture screen and audio content, steal emails and Telegram/WhatsApp data from web browsers, and wipe the computer system.

Organizations targeted by Chosen Brick should contact their IT providers for investigation. The latest Iran alert follows a series of water and energy cyberattacks attributed to Iran, although formal attribution has been avoided as tensions with the US escalate.