UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists

September 15, 2026 · NCSC UK · Severity: HIGH

UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.

Key Takeaways

UK and allied governments have exposed CHOSEN BRICK spyware used by Iranian state actors to target dissidents, activists, and journalists for surveillance and harassment.
The advisory provides technical indicators and detection guidance to help at-risk individuals and organizations identify and counter the CHOSEN BRICK malware threat.
CHOSEN BRICK represents an increasingly common pattern of state-developed spyware being deployed against civil society targets across multiple jurisdictions.