Loading story…
An Iranian threat actor is targeting Iranian nationals living abroad—including dissidents, activists, and journalists—through tailored social-engineering messages on Telegram and WhatsApp. The operators impersonate known contacts or platform support personnel, cultivate trust, and lure victims into opening apparently legitimate applications or files presented as MRI scan results; the files deploy the CHOSEN BRICK trojan.
CHOSEN BRICK appears built for espionage on an individual endpoint and has no identified lateral-movement capability. While the campaign chiefly threatens the privacy and safety of targeted individuals, operators initially pursue work or corporate devices and may switch to personal devices when delivery fails or detection risk rises, indicating a possible secondary objective of harvesting credentials for access to corporate networks.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
An Iranian threat actor conducted a cyber-espionage campaign against Iranian nationals living abroad, including dissidents, activists, and journalists. The actor used Telegram or WhatsApp impersonation and social engineering to induce victims to open malicious applications or purported MRI results that installed the CHOSEN BRICK trojan.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK National Cyber Security Centre, FBI, and Netherlands AIVD have disclosed an Iranian state-linked campaign using **CHOSEN BRICK** Windows spyware against dissidents, activists, journalists, and other perceived opponents of the Iranian regime, including victims in the UK, United States, and Netherlands. Active since at least 2025, operators impersonate trusted contacts on WhatsApp and Telegram, cultivate relationships with targets, and deliver tailored malicious files masquerading as legitimate applications or documents; one reported lure used fabricated MRI scan results. CHOSEN BRICK establishes reboot persistence, weakens Microsoft Defender protections, and uses victim-specific Telegram bots for command and control. It can collect screenshots, microphone audio, emails, files, browser-accessible WhatsApp and Telegram data, and system information, while exfiltrating data through Telegram and cloud object stores and deploying additional malware. The agencies warned that stolen information has appeared on pro-Iranian leak sites, enabling profiling and harassment and potentially increasing targets' physical-safety risks; they released indicators and mitigation guidance.
Sep 17, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Check Point Research reported that the **Rampant Kitten** espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including **Telegram Desktop** files, **KeePass** password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime. Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including **TelB**, **TelAndExt**, a Python infostealer, and **HookInjEx**. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Aug 15, 2026