US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
Source SecurityWeek
Description
Chosen Brick is a Windows malware family used by Iranian state-sponsored actors to surveil dissidents, activists, and journalists globally. Active since at least 2025, it harvests personal data such as contacts, emails, and social media messages to track individuals. Infection typically begins via messaging platforms like WhatsApp and Telegram, using social engineering to deliver malicious files disguised as legitimate utilities or medical documents. The malware establishes persistence through registry keys, evades Microsoft Defender by adding exclusions, and uses Telegram bots for command-and-control and data exfiltration. It can capture screenshots, record audio, steal browser chat data, deploy secondary payloads, and wipe data on command. The FBI and allied agencies have published advisories detailing its use and infrastructure. No automated lateral movement is observed, but operators can manually expand access via secondary payloads.