UK, US, and Netherlands issue warning over Iranian spyware

On September 15, 2026, the United Kingdom, the United States, and the Netherlands issued a joint cybersecurity advisory regarding a sophisticated spyware campaign attributed to Iranian state-linked actors. The operation, which targets dissidents, activists, and journalists worldwide, utilizes a family of malware known as 'CHOSEN BRICK' to infiltrate private devices and compromise sensitive data.

The National Cyber Security Centre (NCSC) of the UK identified that the attackers employ 'spear-phishing' techniques across messaging platforms such as WhatsApp and Telegram. By successfully infiltrating these accounts, the perpetrators gain access to emails, private messages, and other personal files. Paul Chichester, NCSC Director of Operations, stated that this activity demonstrates a systematic effort by the Iranian state to suppress critics and monitor individuals globally through digital surveillance.

Security experts note that these cyber campaigns pose a significant threat to global civil society. The investigation highlights how restrictive regimes leverage specialized digital tools to silence opposition, posing ongoing risks to the safety and professional integrity of journalists and activists operating internationally.