Western intelligence agencies highlight ‘CHOSEN BRICK’ spyware targeting critics of Iran government abroad.
Published On 15 Sep 2026
The United States, the United Kingdom and the Netherlands have warned that Iranian spyware is being used to hunt dissidents living in the West.
Iran is “almost certainly” using cyber operations to target Iranian critics of the regime, intelligence agencies from the trio of countries cautioned on Tuesday.
In coordinated advisories, the FBI in the US, Britain’s National Cyber Security Centre (NCSC) and the Netherlands’ AIVD intelligence service all repeated the same warning.
“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” said Paul Chichester, the director of Britain’s NCSC.
Chichester highlighted a spyware family known as “CHOSEN BRICK” that is allegedly used by Iranian state-linked cyber actors to steal sensitive information through “spear-phishing” campaigns on messaging platforms including WhatsApp and Telegram.
The FBI said that Iran’s Ministry of Intelligence and Security (MOIS) was using the malware to “collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets”.
The advice is a continuation of regular warnings issued by Western intelligence over Iran’s efforts to target dissidents abroad.
In a warning issued in March, the FBI had described alleged MOIS efforts to use the malware to collect data on targets that was then posted online by a persona known as “Handala Hack.”
That attack in March crippled the global networks of Stryker, one of the world’s largest medical device companies, with an Iran-linked hacking group claiming responsibility and warning it marked “the beginning of a new chapter in cyber warfare”.
The so-called Handala hackers also claimed to have gained access to the personal emails of Kash Patel, the director of the US Federal Bureau of Investigation (FBI), sharing photographs and documents from the official online.
In July, US officials said a cyberattack on water systems in the state of Minnesota resembled the “Handala Hack”.
