Iran-linked 'Chosen Brick' malware targets dissidents and journalists

A joint security advisory from the UK’s NCSC, the FBI, and the Netherlands’ AIVD has exposed a sophisticated cyber-espionage campaign attributed to Iranian operatives. The campaign utilizes a custom malware strain dubbed 'Chosen Brick' to target dissidents, activists, and journalists deemed threats to the regime. Attackers employ social engineering tactics, often posing as acquaintances or technical support on social media to gain the trust of their targets. Once installed on Windows systems, Chosen Brick enables extensive surveillance, including audio recording, screen capture, and the theft of sensitive data from messaging apps like WhatsApp and Telegram. The malware can also download additional payloads or wipe systems entirely. Intelligence agencies emphasize that the primary defense against such threats is heightened awareness of social engineering, alongside robust technical measures such as phishing-resistant multi-factor authentication, regular software updates, and active endpoint monitoring to detect indicators of compromise.