Iranian State-Linked Hackers Deploy CHOSEN BRICK Windows Malware in Global Surveillance Campaign

Government agencies have issued a warning about a new Windows malware strain, dubbed CHOSEN BRICK, attributed to Iranian state-linked hackers. The malware is being used in a global surveillance campaign targeting dissidents, activists, and journalists, according to a report by BleepingComputer on September 16, 2026.

The advisory, based on government intelligence, indicates that the threat actors are employing CHOSEN BRICK to compromise Windows systems and conduct espionage. The exact infection vector remains undisclosed, but such campaigns often rely on phishing or social engineering. The malware's capabilities appear focused on stealthy data collection and monitoring, posing significant privacy and security risks to the targeted individuals.

The campaign's global reach highlights the persistent threat posed by state-sponsored actors to civil society. While specific technical details are limited, the warning emphasizes the need for heightened vigilance and defensive measures among at-risk groups.

Organizations and individuals, particularly those in human rights, journalism, and activism, should review their security posture. Recommended actions include keeping systems patched, using reputable antivirus and endpoint detection tools, enabling multi-factor authentication, and being cautious with unsolicited communications. In case of suspected compromise, incident response procedures should be activated promptly.

The full scope of the campaign and the identity of the specific threat actor group remain unconfirmed, but the advisory serves as a critical reminder of the evolving cyber threats facing civil society.