US, UK, and Netherlands warn of Iranian spyware targeting dissidents abroad

Britain, the United States, and the Netherlands issued coordinated cybersecurity advisories on Tuesday warning that Iran is using the "CHOSEN BRICK" spyware to target regime critics.

• The three countries' intelligence agencies — Britain's NCSC, the US FBI, and the Dutch AIVD — said Iran is "almost certainly" using cyber operations to target Iranian dissidents abroad.
• State-linked Iranian actors allegedly use the spyware in spear-phishing campaigns on WhatsApp and Telegram to steal emails, messages, and other sensitive data, the NCSC said.
• NCSC operations director Paul Chichester said the campaign details show Iran uses digital surveillance to repress critics, stealing emails and messages and accessing devices.
• The FBI said Iran's Ministry of Intelligence and Security uses the malware to "collect intelligence, conduct data leaks, and inflict reputational harm," and that the warning updates a March 2026 advisory tied to the "Handala Hack" persona.