\n<\/p>\n
LONDON: Britain, the United States and the Netherlands on Tuesday issued a joint cybersecurity advisory detailing spyware they say is used by \u200bIranian state-linked actors to target dissidents, activists and journalists.<\/strong><\/p>\n Britain\u2019s National Cyber Security Centre \u200csaid Iranian state-linked cyber actors had used a spyware family known as \u201cCHOSEN BRICK\u201d to steal emails, messages and other sensitive information through \u201cspear-phishing\u201d campaigns on messaging platforms including WhatsApp and Telegram.<\/span><\/p>\n \u201cThe details of this cyber campaign reveal \u202fhow \u200bIran ruthlessly uses digital surveillance in pursuit of\u202f its\u202f aim\u202f to \u202frepress critics of the \u200bregime, stealing emails and messages and accessing devices,\u201d Paul Chichester, NCSC director of \u2060operations, said in a statement.<\/span><\/p>\n Iran\u2019s embassy in London did not immediately respond to a request \u200bfor comment.<\/span><\/p>\n The malware, according to the advisory, can collect information from contact lists, emails and social \u200bmedia accounts, capture screen content and access a device\u2019s microphone. The NCSC said some victims\u2019 personal details had later appeared on pro-Iranian leak sites. The FBI, in its own advisory, opens new tab, said Iran\u2019s Ministry of Intelligence and Security (MOIS) \u200bwas using the malware to \u201ccollect intelligence, conduct data leaks, and inflict reputational harm against their \u200bintended targets.\u201d<\/span><\/p>\n The FBI declined to share additional details on how many people have been targeted with the malware, \u200cor where \u2060they\u2019re located.<\/span><\/p>\n The NCSC said the attackers often posed as trusted contacts on messaging apps and tailored their approach to individual targets. In some cases, it said, they used fake documents, including fabricated MRI test results, to persuade victims to download the malware.<\/span><\/p>\n The NCSC, alongside the FBI and \u200bthe Netherlands\u2019 AIVD intelligence \u200bservice, said Iran \u201calmost certainly\u201d \u2060uses cyber operations to help suppress people it sees as threats.<\/span><\/p>\n The FBI\u2019s advisory said it was an update to a March 2026 warning \u200bdescribing alleged MOIS efforts to use the malware to collect data on \u200btargets, which \u2060was then posted online by a hacking persona known as \u201cHandala Hack.\u201d<\/span><\/p>\n Handala has targeted multiple U.S. companies and people since the start of the Iran war, including a destructive cyberattack against Michigan-based medical supplies and \u2060services supplier \u200bStryker in March, and the leak of FBI Director Kash \u200bPatel\u2019s personal emails later that month.<\/span><\/p>\n