UK, US and Netherlands issue advisory on Iran-linked spyware

Three Western nations have issued a cybersecurity advisory regarding Iranian-linked spyware. The National Cyber Security Centre of Britain, the FBI, and the Netherlands' AIVD intelligence service jointly warned of the threat posed by the malware known as CHOSEN BRICK. This spyware targets dissidents, activists, and journalists, stealing sensitive information through spear-phishing campaigns on messaging apps like WhatsApp and Telegram.

The malware can gather data from contact lists, emails, social media accounts, capture screen content, and access a device's microphone. Some victims' personal details have since surfaced on pro-Iranian leak sites. The FBI stated Iran's Ministry of Intelligence and Security (MOIS) employs the malware for intelligence collection, data leaks, and causing reputational harm.

The NCSC and FBI declined to disclose the exact number of individuals targeted by the malware or their locations. The advisory is an update to a March 2026 warning about MOIS using the malware to gather data on targets, which was later shared online by a hacking persona called Handala. Handala has targeted various U.S. companies and individuals since the beginning of the Iran war, including a destructive cyberattack on Michigan-based medical supplier Stryker in March and the leak of FBI Director Kash Patel's personal emails in April.