Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian hackers use CHOSEN BRICK malware to spy on dissidents, activists, and journalists.
Iranian state-linked hackers are deploying a Windows malware called CHOSEN BRICK to target dissidents, activists, and journalists globally. The malware is capable of stealing communications, taking screenshots, recording audio, and can even wipe entire systems. Attackers use social engineering to trick victims into installing the malware, which then communicates via Telegram bots and exfiltrates data through cloud services or pro-Iranian leak sites.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Defender?
Get an email when a new story names Microsoft Defender, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIranian state-linked threat actors are leveraging social engineering tactics to trick high-risk individuals — including activists, journalists, and dissidents — into voluntarily installing the CHOSEN BRICK malware on their Windows devices. Once installed, the malware exfiltrates sensitive communications, captures screenshots, records audio, and can even wipe systems entirely, leaving victims with no recourse. The use of Telegram bots and cloud services for command-and-control makes detection significantly harder for traditional security tools. This campaign underscores that technical vulnerabilities are not always the entry point — human trust and lack of awareness remain among the most exploited attack surfaces. Protecting high-risk populations requires both technical controls and robust security education tailored to their threat environment.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CHOSEN BRICK