The file looked like an MRI scan. Lumbar spine, several grey slices of vertebrae, a heading reading something like 'Disk Herniation and Degeneration.' For a dissident living in exile - someone with a body that has been through things, someone waiting on results - it was a plausible thing to open.

Opening it handed Iranian intelligence the microphone.

That lure, reproduced in a joint advisory published Monday by Britain's National Cyber Security Centre, the U.S. Federal Bureau of Investigation and the Netherlands' General Intelligence and Security Service, is one of several used to deliver a spyware family the NCSC has named "CHOSEN BRICK." The three agencies say Iranian state cyber actors have used it since at least 2025 against dissidents, activists and journalists worldwide, including in all three of their countries.

What makes the campaign notable is not its technical sophistication. By the standards of state espionage, CHOSEN BRICK is unglamorous - Windows only, no automated spread, command-and-control running over Telegram bots. What makes it notable is the patience of the human work wrapped around it, and what appears to happen to the data afterward.

Getting to know you first

The operators do not spray phishing links. They research a target, then open a conversation on WhatsApp or Telegram posing either as someone the target already knows or as technical support from the messaging platform itself. Then they talk. The advisory describes rapport-building as a distinct phase of the attack chain, drawing on what it calls extensive target knowledge gathered in preparation.

Only after that does a file arrive, themed to whatever the conversation has been about — a video tool like Pictory or RunwayML, a password manager, an antivirus installer, medical results. Open it and a convincing screen appears: a real-looking Pictory login page, a real-looking scan. Behind it, the implant installs.

The single most telling detail in the advisory is a paragraph about which device gets hit. The actors often approach a target's work computer first. If that fails, or if detection looks likely, they ask the target to open the file at home instead - deliberately steering the victim off a monitored corporate machine and onto the personal laptop where nobody is watching. That is not a technical exploit. It is an understanding of how a journalist's life is actually configured.

What CHOSEN BRICK malware does

A bot for every victim

Once installed, the malware survives reboots through a registry run key, writes itself Microsoft Defender exclusions, and reports to a Telegram bot. It can enumerate running processes, grab the screen, switch on the microphone, lift Telegram and WhatsApp session data out of browsers, pull email, download further payloads and delete files. The NCSC says one sample also carried data-wiping functionality, though the FBI's own 55-page technical breakdown, published the same day, documents no wiper.

Two design choices stand out. First, each infected device talks to its own unique Telegram bot ID — an operational security measure, the advisory notes, to prevent cross-contamination between victims. The people hunting dissidents are careful to compartmentalize their victims from one another.

Second, one payload documented by the FBI kills the real WhatsApp process and substitutes a trojanized copy, rewriting the desktop shortcut to point at it. The victim keeps using WhatsApp. WhatsApp keeps working. Another sample dumps entire Outlook mailboxes, attachments included, to a zip archive. Others stage screen and audio recordings into password-protected archives before shipping them out through Telegram or cloud object storage.

The FBI calls the same malware HEAVYGRAM, and goes considerably further than its British counterpart on attribution. Its report states plainly that the activity is conducted "on behalf of the Government of Iran's Ministry of Intelligence and Security" — MOIS. The NCSC advisory says only "Iranian state cyber actors." That gap between two co-signing agencies is unusual enough to be worth noticing.

Where the data goes

Espionage against exiles would be alarming enough. The advisory's quietest sentence is the one that should worry readers most: personal details of some previous CHOSEN BRICK victims have turned up on pro-Iranian leak sites.

That is the hinge between surveillance and harm. A stolen contact list is not just intelligence; published, it is a map of everyone a dissident in London still speaks to in Tehran. In May, Global Affairs Canada documented a July 2025 hack-and-leak by the Iran-linked Handala persona that exposed five Iran International staff — passports, driver's licences, permanent resident cards, email passwords, and intimate photographs — then amplified the material across social platforms. The U.S. Justice Department seized four Iranian-linked leak and harassment domains in March 2026, and the FBI has separately assessed that some data posted by Handala was obtained using this malware. No public document yet ties the Iran International leak specifically to CHOSEN BRICK, but the timelines converge uncomfortably.

Read: Iran-Linked Handala Hackers Launch New Domain Hours After FBI Seized the Older One

Paul Chichester, the NCSC's director of operations, said the campaign shows how Iran "ruthlessly uses digital surveillance in pursuit of its aim to repress critics," urging those at risk to study the social-engineering patterns described and act on the advice. Dutch intelligence said victims in the Netherlands have been informed. No agency published a victim count, and none should be inferred.

Why a microphone matters

The reason a spyware advisory about contact lists and screenshots reads like a physical-safety story is that, in this particular threat model, it is one.

Ruhollah Zam ran a Telegram channel with more than a million followers from exile in Paris. In October 2019 he was lured to Iraq with the offer of an exclusive interview, seized on arrival, and hanged in December 2020. Masih Alinejad, the Iranian-American journalist, survived both a plot to render her out of New York and a murder-for-hire attempt; two men were sentenced to 25 years each in October 2025. Pouria Zeraati, an Iran International presenter, was stabbed outside his London home in March 2024; two men were jailed at the Old Bailey in July 2026, where the judge found the attack was carried out for the benefit of a foreign power.

MI5 Director General Sir Ken McCallum said in his October 2025 threat update that the service had tracked "more than 20 potentially lethal Iran-backed plots" in a single year — roughly matching the total for the preceding three.

Against that backdrop, a stranger's warmth on WhatsApp and a file that looks like your scan results are not a nuisance. They are reconnaissance. The advisory's most practical instruction is also its bluntest: do not let a persuasive contact move you onto the device where no one is watching.

At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country.

The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at the University of Toronto and by Amnesty International's Security Lab.

Citizen Lab, in its own findings, said it verified an infection with NSO Group's Pegasus on the iPhone of a student activist who asked not to be named. High-confidence infection indicators span December 2025 through January 2026, delivered by a zero-click iMessage exploit that required no interaction from the target. Apple has since patched the underlying flaw; the fix shipped in iOS 18.4.1. Pegasus grants an operator access to notes, photographs and messages decrypted on the device, and can silently activate the microphone and camera.

Amnesty's Security Lab confirmed a new variant of NoviSpy, an Android implant first identified in Serbia in 2024, on two additional devices. SHARE said the rebuilt version was designed to evade the detection methods that exposed its predecessor.

Also read: Investigative Journalists in Serbia Hit by Advanced Spyware Attack

The circumstances of two infections are what elevate the findings beyond routine spyware reporting. SHARE said one NoviSpy infection appeared after police seized a student's phone during questioning, and another after private messages from that device were published by a pro-government media outlet. Donncha Ó Cearbhaill, who heads Amnesty's Security Lab, said the evidence suggests "infections are being carried out during detention by Serbian authorities."

Suspicion centers on Serbia's Security Information Agency, or BIA. Amnesty's December 2024 report "A Digital Prison" found earlier NoviSpy samples configured to send collected data to IP addresses associated with BIA servers, and documented the agency's parallel use of Cellebrite extraction tools on journalists and activists. In March 2025, Amnesty reported that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus.

The current cases surfaced through Apple's threat notification wave of Aug. 13, which reached users in 110 countries. The timing is politically loaded. The targeting overlaps with protests that followed the November 2024 collapse of a railway station canopy in Novi Sad, spans local elections held March 29 in 10 municipalities, and precedes October parliamentary elections widely read as a test of the ruling Serbian Progressive Party.

Ana Toskic Cvetinovic, a legal expert cited in the reporting, noted that deploying intrusive software without judicial authorization is unlawful under Serbian law. SHARE published an analysis of the domestic legal framework in January arguing the same. Criminal complaints filed over the 2024 cases remain pending before Serbian courts, with no resolution.

Also read: 7 New Pegasus Infections Found on Media and Activists’ Devices in the EU

NSO has been on the U.S. Commerce Department's Entity List since 2021.

Serbia is an accession candidate, the European Parliament has previously questioned the Commission over unlawful spyware use in the country, and the Commission published its 2026 enlargement country report in July. Amnesty's submission for that package raised surveillance directly.

Both groups urged at-risk users to enable Lockdown Mode on iOS or Advanced Protection on Android.

The New York Times has a long article (alt link) on surveillance systems aimed at babies. They are increasingly using AI.

Nanit and its rivals want to own 24/7 health tracking for the sub-four-foot set. And their already astonishing levels of baby data collection are just the beginning. Nanit recently raised $50 million from investors to expand its use of A.I. and use its camera to track speech and language development, motor skills and more, while extending its presence in children’s bedrooms into early adolescence.

Apple has expanded its threat-notification system for targets of mercenary spyware.

Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.

In the explanation, Apple states:

“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”

“Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”

Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.

Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.

Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.

How to stay safe

Apple advises users to:

• Update your devices to the latest software, which includes the latest security fixes.
• Protect your devices with a passcode, Touch ID, or Face ID.
• Use two-factor authentication and a strong password for your Apple Account.
• Turn on Stolen Device Protection.
• Install apps from the App Store.
• Use strong and unique passwords, and passkeys where available.
• Don’t open links or attachments from unknown senders.

We’d like to add:

• Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
• Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
• If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android →