Cybersecurity and intelligence agencies in the US, UK, and Netherlands have issued a joint advisory warning of a Windows malware family dubbed Chosen Brick, deployed by Iranian state cyber actors to target dissidents, activists, and journalists worldwide.
Active since at least 2025, Chosen Brick is leveraged by Iranian operators to harvest contacts, emails, social media messages, and other types of data that can be used to track an individual’s location and life patterns.
The agencies noted that the activity directly supports state-sponsored repression against individuals perceived as threats to the regime, with stolen personal information occasionally posted to pro-Iranian leak sites to harass targets.
The attack chain typically begins on messaging platforms such as WhatsApp and Telegram. Operators research their targets to build rapport, often posing as acquaintances or platform technical support representatives before delivering weaponized files.
Attackers frequently initiate contact through a target’s corporate device. However, if security controls block delivery, the attackers try to shift the interaction to the individual’s personal device to bypass enterprise protections.
To trick victims, threat actors disguise malicious installers as legitimate utility software or as fake medical documentation, such as MRI scan results. When opened, the file displays a decoy screen while stealthily executing the malware in the background.
All observed infections have targeted Windows. Upon execution, Chosen Brick establishes persistence across reboots using registry Run keys and attempts to evade local security tools by adding exclusions in Microsoft Defender.