Iranian spies hit Windows machines with Chosen Brick data-stealing malware

As cited

Copy frozen at 2026-09-15 20:29 UTC (site build).

threat intel

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

Iranian state cyber actors are deploying Chosen Brick, a data-stealing malware, against individuals via social messaging apps to conduct surveillance and extract contacts, emails, and social media messages from Windows systems. The FBI, UK National Cyber Security Centre, and Netherlands' General Intelligence and Security Service warned that these campaigns use extensive social engineering through WhatsApp and Telegram, impersonating trusted contacts to trick victims into downloading trojanized applications. The malware establishes persistence, disables antivirus protections, and communicates via Telegram for command-and-control while potentially enabling lateral network movement and deployment of secondary payloads.

Why it matters: Organizations and individuals in regions targeted by Iran, including those with employees or contacts abroad who may be dissidents or activists, face risk of device compromise and operational security exposure through personal device infections that could pivot to corporate networks.

Source published

2026-09-15 18:01 UTC

First seen by Cybersecurity Tracker

2026-09-15 19:32 UTC