The Insider’s retelling says that NCSC, the U.S. FBI and the Dutch AIVD service warned about the Chosen Brick campaign, which, according to them, is used by hackers linked to Iranian intelligence services. Attacks have been recorded in the UK, the U.S. and the Netherlands since at least 2025.
According to the intelligence services, the malware gives access to the victim’s contacts, messages in messengers and email. This makes it possible to track their movements and circle of contacts, and the personal data of some victims later appeared on pro-Iranian websites for publishing leaks.
Attacks usually begin in WhatsApp and Telegram: the attacker poses as someone the victim knows or as the platform’s support service and persuades them to open an infected file. Attachments are disguised as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, or as files with MRI results.
First, the hackers try to infect a work device, and if that fails, they move the correspondence to a personal phone or computer to bypass corporate protection. Chosen Brick works only on Windows, persists in the system through registry keys, and can disable part of Microsoft Defender protection.
Communication with the operator goes through a bot in Telegram, and each infected machine has its own unique bot. Through it, they can turn on the microphone and camera, take screenshots, export correspondence from Telegram and WhatsApp, steal mail, delete files, and completely erase data from the computer. Stolen files are sent through the Telegram bot and cloud storage, and in the latest versions the malware additionally disguises traffic. The intelligence services recommend checking autorun in the Windows registry, not installing programs from sent links or attachments, regularly updating devices, and enabling two-factor authentication.
In June 2025, after Israeli strikes on Iranian territory, it was reported that the Iranian authorities sharply intensified the hunt for people suspected of cooperating with Israeli intelligence and of criticizing the regime. At the same time, dozens of arrests on suspicion of spying for Mossad were known.
Sources
