Chosen Brick Spies on You Silently

Article by Nacata Security, 17/09/2026

Did you know that a government can spy on you from your own personal phone?

Iran has been doing it for months with a malware called Chosen Brick.

The security agencies of the United States, the United Kingdom, and the Netherlands have just published a joint alert about this surveillance tool that has been active since 2025.

The goal is not to steal money or corporate data: it is to track the entire lives of dissidents, activists, and journalists whom the Iranian regime considers a threat.

The deception begins in your favorite messaging app.

Operators research their targets for weeks before making contact. They pose as acquaintances or as WhatsApp and Telegram technical support, build trust, and then send a trap file. If the corporate device has controls that block delivery, they pressure the victim to continue from their personal phone. The file may appear as a utility program or as MRI scan results.

You open the file and notice nothing unusual.

That is exactly what they are looking for. While a decoy screen distracts your attention, the malware installs itself silently. Once inside your Windows system, Chosen Brick latches onto it through Run registry keys to survive every reboot, and adds exclusions in Microsoft Defender so the antivirus does not detect it.

Each victim receives their own Telegram bot as a control channel.

This is how it exfiltrates data without raising suspicion: it uses Telegram and cloud storage services to extract screenshots, audio recordings, emails, and browser conversations. The FBI has confirmed this use of Telegram as a command-and-control channel in Iranian attacks.

Surveillance can turn into destruction in seconds.

Chosen Brick does not just spy: its operators can execute commands to wipe data from the infected device. That means the same tool used to track you can silence you in an instant. And there is something else that deserves attention.

The Iranian cyberespionage pattern goes further.

Chosen Brick is not an isolated incident. Iran has spent years building a digital surveillance infrastructure to silence critical voices inside and outside its borders. Groups linked to the regime have been implicated in attacks on critical infrastructure and influence operations across multiple countries. The malware does not target abstract systems: it targets specific individuals and their daily movements.

The stolen data is used to reconstruct your entire life.

Contacts, emails, social media messages, and location patterns are combined to build a detailed map of each victim. That profile allows the regime to anticipate movements, identify support networks, and exert pressure on family members still inside Iran, multiplying the damage.

Three countries had to join forces to expose this operation.

The fact that a joint alert of this magnitude was necessary says a great deal about the sophistication of the actor. We are not dealing with a group of opportunistic cybercriminals, but with a state apparatus that has resources, patience, and very clearly defined political objectives.

The personal device is the weakest link.

Attackers know this and exploit it deliberately. If your company has strong controls in place, they will try to slip in through your private phone or personal email. That is why the separation between personal and professional digital life matters more than it might seem, especially if you work in journalism, activism, or research.

Protecting yourself starts with questioning who is writing to you.

An unexpected message from someone who claims to know you, or a file that no one asked you to send, could be the first brick of Chosen Brick in your life.

Are you sure you really know who is writing to you?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime