NCSC and Allies Warn of Iranian Spyware Campaign

The UK and its allies have warned opponents of the Iranian regime that they may be subject to targeting by a Tehran-backed spyware campaign.

An advisory published yesterday by the National Cyber Security Centre (NCSC), the FBI and the Netherlands' General Intelligence and Security Service (AIVD) is designed to help dissidents, activists and journalists critical of the regime.

It warned that, in some cases, information stolen by the spyware has appeared on pro-Iranian leak sites, increasing the risk to victims’ personal safety.

“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” said NCSC director of operations, Paul Chichester.

“With our international partners, we strongly encourage individuals at risk to familiarize themselves with the social-engineering techniques described in the advisory, and to act on the mitigation advice.”

Read more on Iranian threats: US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks.

The campaign itself revolves around the delivery of Chosen Brick: spyware designed to harvest targets’ contacts, emails and social media messages, to enable tracking of their movements, repression or worse.

The malware itself uses Windows registry keys for persistence and adds exclusions to Microsoft Defender antivirus in order to evade detection, the report revealed.

It connects to Telegram for command & control (C2) and has a wide variety of functionality including enumeration of running processes and system info, screen capture, harvesting Telegram and WhatsApp data from browsers, stealing emails and enabling the device mic for audio capture.

It can also delete files, download additional malware, and wipe the entire system, the NCSC said.

Chosen Brick is delivered via social engineering. The threat actor builds rapport with their victim on social media – usually by impersonating a contact or social messaging technical support. Then they persuade the victim to download a legitimate app (eg Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player) or file (e.g. MRI scan).

Advice for Targets

The advisory urged organizations concerned about infection to contact internal or external IT providers to investigate.

“As this actor targets personal devices, not just corporate devices, organizations are recommended to circulate this with their staff that are likely to be targeted and support them in checking their personal devices too,” it added.

On the plus side, the spyware interacts with numerous legitimate web services, so it’s likely to appear in corporate logs through DNS and web proxy services, the NCSC noted.

Best practice mitigations include:

• Following NCSC advice on staying safe online, such as not clicking on download links or attachments
• Switching on automatic updates for device OS and software
• Enabling trusted AV and ensuring it’s up to date
• Not disabling or ignoring smart screen warnings on file downloads

Network admins should also consider enabling phishing-resistant MFA, managing and protecting device fleets with AV, app allowlisting and other controls, and installing endpoint and network monitoring, the report advised.

The campaign has been running since at least 2025, the NCSC said.