‹ News Blitz Science & Technology Developing

Joint advisory warns of spyware targeting Iranian dissidents abroad

English हिंदी ಕನ್ನಡ മലയാളം தமிழ் తెలుగు

First brief 16 Sep, 5:55 am IST Updated 16 Sep, 5:55 am IST 0 developments 3 min read

File: GCHQ headquarters, Cheltenham — Ian S · CC BY-SA 2.0

Where it stands

A message that appears to come from a trusted contact can become the starting point for surveillance. A joint advisory issued on 15 September 2026 describes attackers building trust before persuading people to open a malicious file. The UK’s National Cyber Security Centre, the FBI and the Netherlands’ AIVD attribute this campaign to Iranian state-linked actors. Their targets include dissidents, activists and journalists outside Iran. The agencies identify the spyware as CHOSEN BRICK and say it has been used since at least 2025. The observed attacks use messaging services such as WhatsApp and Telegram to approach targets, but the reported malware infections affect Windows computers. The spyware can capture screens, access microphones and collect emails or messaging data from an infected device. Information taken in this way can expose contacts and movements, and some victims’ details have appeared on leak sites. The warning therefore concerns both digital privacy and personal safety. It does not establish that every user of those messaging apps is infected, or that simply receiving a message installs this malware.

Background

People often judge an online message by who seems to have sent it. Attackers can exploit that habit by impersonating someone familiar or claiming to provide technical support. This is social engineering: manipulating a person into taking an action that weakens security. When the approach is tailored to a specific person’s interests or circumstances, it is commonly called spear-phishing. In the campaign described by the agencies, the attackers first learn about the intended target and build a believable conversation. They then offer a file that appears to be useful software or a relevant document. Opening that file can install spyware while showing something apparently legitimate on screen. The deception matters because the victim may believe the requested task worked normally and not notice the hidden installation. Once spyware controls a device, the risk extends beyond the original conversation. Screen captures, stored messages and microphone access can reveal information from several parts of a person’s life. Contacts may identify other people, while repeated observations can expose patterns of movement. Publishing stolen personal details can create further danger for someone already facing political intimidation. The advisory brings these links together as a warning about surveillance across borders. Its attribution is the agencies’ assessment, not a court finding or a claim independently proved by this article. The practical response is to reduce opportunities for deception and investigate suspected compromise. Keeping software updated helps, but users also need to question unexpected files and avoid disabling security warnings to open them.

How it developed

15 September 2026

How it started
The advisory explains the route from trusted message to device surveillance

The UK, US and Dutch agencies describe approaches made through messaging apps while impersonating familiar people or technical support. Attackers persuade targets to download and open files disguised as legitimate applications or documents. In the cases observed, the malware targets Windows devices and can remain active after a restart. The campaign’s history reaches back to at least 2025, so the advisory date is not its starting date. The guidance recommends obtaining software from its legitimate download site or an official app store, rather than installing unexpected attachments. It also recommends keeping applications and operating systems updated, maintaining antivirus protection and respecting download warnings. Organisations with suspected infections should seek help from their IT providers, including checks of personal devices used by at-risk staff. These precautions reduce risk; they do not guarantee that a device is clean or that all future attacks will fail.

NCSC / FBI / AIVD UK National Cyber Security Centre Al Jazeera

Why it matters for UPSC

GS3 · Cyber securityGS2 · Rights and international relations

For GS3, connect social engineering, device compromise and data theft as different stages of a cyber threat. For GS2, examine how digital surveillance can affect the safety and rights of people living abroad. Preserve the distinction between an agency’s attribution, observed technical behaviour and claims that remain unproven.

Key terms

SpywareMalicious software used to collect information from a device without the person’s informed permission. Its capabilities can include capturing screens or accessing messages and microphones. The word describes the surveillance function; the specific capabilities depend on the malware involved.

Social engineeringManipulating a person into doing something that helps an attacker, such as opening a deceptive file. It relies on trust, urgency or another human response rather than only a technical weakness. Impersonating a familiar contact is one example in this advisory.

Spear-phishingA targeted deceptive approach designed for a particular person or organisation. Attackers use information about the target to make a message convincing. Unlike a generic scam sent widely, a tailored approach may refer to the recipient’s interests or pretend to come from someone known.

CHOSEN BRICKThe name used in the joint advisory for a malware family associated with the reported surveillance campaign. The observed infections target Windows devices. Its capabilities include screen capture, microphone access and collection of messages or emails; the name does not describe an ordinary messaging-app feature.

Device compromiseA situation in which an attacker gains unauthorised access to or control over a device. The danger is broader than a single suspicious message because information from other applications may become accessible. Receiving an unwanted message alone is not proof that compromise has occurred.

Cyber attributionAn assessment of who is responsible for a cyber operation, based on evidence gathered by investigators or security agencies. Here, the agencies link the campaign to Iranian state actors. Reporting that assessment is different from presenting it as a judicial finding or independently established guilt.

Transnational repressionEfforts by a state to intimidate, surveil or otherwise target perceived opponents outside its own borders. Digital attacks can form part of such pressure when stolen information exposes contacts or movements. The concern connects cyber security with personal safety and civil rights.

National Cyber Security CentreThe UK agency issuing this warning with the FBI and the Netherlands’ AIVD. It is part of GCHQ and provides cyber-security advice and support. An advisory shares assessed threats and protective guidance; it is not a statement that every reader’s device has been infected.

Sources (3)

NCSC / FBI / AIVD · official · Iranian cyber targeting of dissidents, activists and journalists
UK National Cyber Security Centre · official · UK and allies expose spyware used by Iranian state actors
Al Jazeera · Western intelligence warns of Iranian cyber threats targeting dissidents