US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Iranian state actors deployed 'Chosen Brick,' a Windows-based surveillance malware, to systematically harvest sensitive personal data — including contacts, emails, and social media messages — from dissidents, journalists, and activists. The stolen information was weaponized for harassment campaigns and published on pro-Iranian leak sites, demonstrating how surveillance malware can cause real-world physical and reputational harm beyond the digital realm. At-risk individuals, particularly those opposing authoritarian regimes, often lack the technical awareness to recognize sophisticated spyware infections on their devices. This case underscores that state-sponsored threat actors increasingly target civil society, not just government or corporate networks, making broad security awareness and device hygiene critical for vulnerable populations.