The UK, US and Netherlands have issued a warning of Iranian spyware targeting dissidents. The middle eastern nation has been accused of utilizing cyber activities targeting Iranian critics of the regime. The Netherlands’ AIVD intelligence service, Britain’s National Cyber Security Centre and the FBI in the US issued coordinated advisories.

Modus Operandi

The hackers used spyware able to steal communications as well monitor the victim’s device. Western intelligence has identified a malware family dubbed CHOSEN BRICK. The former stated that personal details of certain previous victims have been posted on pro-Iranian leak websites. This action could increase risk to the safety of the victims.

Utilization of Spear-Fishing

The identity of the affected individuals or their numbers has so far not been disclosed. The spyware stole emails, messages and miscellaneous data via spear-phishing campaigns on popular messaging platforms such as Telegram, WhatsApp and others. The spyware also captured screen content and accessed device microphones. Sources say Iranian entities had first impersonated contacts on messaging apps. Next, they established rapport with the targets. Finally, the spyware was deployed. For your knowledge, the spyware had been used only on Windows devices.

Taking Advantage after Establishing Trust

Note that the malicious actors had good knowledge of the targets. The former used their relationship with the target to trick them to download legitimate looking files. The director of Britain’s NCSC Paul Chichester stated “The details of this cyber ⁠campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,”.

SOURCES:-

https://www.aljazeera.com/news/2026/9/15/western-intelligence-warns-of-iranian-cyber-threats-targeting-dissidents

https://eutoday.net/iran-spyware-journalists-dissidents-uk-us-netherlands/

https://www.reuters.com/world/uk-us-netherlands-issue-advisory-iran-spyware-2026-09-15/

https://www.iranintl.com/en/202609154179

https://www.computerweekly.com/news/366650300/UK-US-and-Netherlands-warn-over-Iranian-state-spyware-campaign