Iranian cyber spies used fake MRI scan results to hack 'enemy of regime'

NCSC, FBI, and AIVD issued a joint warning about the CHOSEN BRICK spyware used by Iranian hackers to attack dissidents, activists, and journalists. The Windows malware spreads via WhatsApp and Telegram disguised as tech support or files like a fake MRI, stealing contacts, email, screen, and microphone.

• CHOSEN BRICK works only on Windows and restarts after reboot
• Telegram used for control: each victim assigned a separate bot
• Attacks recorded in UK, US, and Netherlands at least since 2025
• FBI links campaign to Handala Hack group and Iran's MOIS