Chosen Brick is a surveillance malware targeting Windows systems, deployed by Iranian state cyber actors since at least 2025. It primarily targets dissidents, activists, and journalists worldwide to collect personal data supporting state repression. Infection vectors include social engineering on messaging platforms such as WhatsApp and Telegram, delivering weaponized files disguised as legitimate software or fake medical documents. Upon execution, it establishes persistence via registry Run keys and attempts to evade detection by adding exclusions in Microsoft Defender. For command-and-control, it uses unique Telegram bot IDs per infected host, leveraging Telegram infrastructure and cloud storage for data exfiltration. Capabilities include screenshot capture, microphone audio recording, browser chat data theft, email theft, secondary payload deployment, and destructive commands like data wiping. While lacking automated lateral movement, operators can manually expand access through additional payloads. The FBI and allied agencies have publicly documented this malware and its abuse of Telegram for C&C.

The malware enables Iranian state actors to conduct extensive surveillance on targeted individuals, harvesting sensitive personal data that can be used to track locations and life patterns. This supports state-sponsored repression, including harassment via posting stolen information on pro-Iranian leak sites. The malware's capabilities to capture screenshots, record audio, steal emails and chat data, and deploy destructive commands pose significant privacy and security risks to victims. The use of Telegram for C&C and data exfiltration complicates detection and attribution. Although no automated lateral movement is present, manual expansion of access increases the threat's persistence and potential impact.

No official patch or remediation is indicated for the malware itself, as it is a threat actor tool rather than a software vulnerability. Defenders should be aware that infection vectors include social engineering via messaging platforms, often targeting corporate devices first and then personal devices if blocked. Security controls should focus on user awareness training to recognize social engineering attempts and suspicious file attachments. Endpoint protection should monitor for persistence mechanisms such as registry Run keys and unusual Microsoft Defender exclusions. Network monitoring for unusual Telegram bot communications may help detect infections. The FBI and allied agencies have published advisories with further guidance; organizations should consult these for detailed mitigation strategies. Since this is malware deployed by threat actors, remediation focuses on detection, prevention of initial compromise, and incident response rather than patching software.