# Iranian Hackers Hide Malware in Fake AI Tools and MRI Files to Spy on Dissidents > Source: > Published: 2026-09-16 07:52:13+00:00 Iranian state-linked operators are hiding a Windows spyware family called CHOSEN BRICK inside fake AI applications, counterfeit antivirus tools and fabricated medical scan results, according to a joint advisory from the UK National Cyber Security Centre (NCSC), the FBI and the Netherlands’ AIVD. The campaign has run since at least 2025 and has hit individuals in the UK, US and Netherlands, with dissidents, activists and journalists among the primary targets. What sets this operation apart is not just the malware itself but who it is aimed at. The advisory says the tooling supports a pattern of transnational repression, in which Iranian intelligence services monitor and, in some documented cases, have pursued kidnapping or lethal plots against people living abroad who are viewed as threats to the regime. That context turns a compromised laptop or phone from a data-security problem into a physical-safety one. The FBI separately tracks the same malware family under the name HEAVYGRAM, so defenders searching threat intelligence feeds should watch for both labels. Below is a breakdown of how the campaign operates, what CHOSEN BRICK does once installed, and what security teams and individuals can do to reduce their exposure. ## How the attack starts According to the advisory, operators build rapport with targets over messaging platforms such as WhatsApp and Telegram before ever sending a malicious file. NCSC researchers, in a report shared with GBHackers, said the attackers rely on detailed prior research into each target so the eventual lure feels specific and credible rather than generic. ### Impersonation and social engineering The attackers have posed as a contact already known to the victim or as technical support staff for a messaging app. To get a foothold, they disguise the malicious payload as familiar, trusted software or documents: | Lure category | Examples cited in the advisory | |---|---| | AI tools | Pictory, RunwayML | | Security software | Norton Antivirus | | Messaging and utility apps | Telegram, Adobe Flash Player, KeePass | | Medical documents | Fabricated MRI results, including one referencing a disk herniation | ### The pivot to personal devices A notable tactic is the deliberate shift away from corporate systems. Attackers often make initial contact through a work device, then try to move the conversation to a target’s personal computer if corporate security controls block execution or raise the risk of detection. That pivot is designed to sidestep enterprise endpoint protection, application allow-listing and centralized monitoring, none of which typically cover an employee’s personal machine. ## Inside CHOSEN BRICK Once a victim opens the disguised file, it displays a decoy screen matching whatever theme was used to lure them in, while quietly downloading and running the core CHOSEN BRICK component in the background. Every documented case so far has involved Windows systems. #### Persistence and evasion The malware sets itself to launch automatically by writing to the Windows Registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a method that works without administrative privileges. It also attempts to add exclusions to Microsoft Defender so its files are less likely to be scanned or removed. In one observed sample, the payload was stored at C:\Windows \SysWOW64, using a deliberate space after “Windows” to create a folder path that looks legitimate at a glance but does not match a genuine Windows directory. #### Command and control through Telegram CHOSEN BRICK communicates with its operators through Telegram, and the advisory notes that each victim is assigned a distinct Telegram Bot ID. That separation limits overlap between infected machines, making bulk detection and attribution harder for defenders. Some recent samples route this traffic through HTTPS and SOCKS5 proxies to further obscure it. ### What the malware can do Beyond maintaining access, CHOSEN BRICK is built for surveillance and, when needed, destruction. Documented capabilities include enumerating running processes and system details, capturing screenshots, recording audio through the microphone, harvesting email content, pulling Telegram and WhatsApp data stored in browsers, downloading additional files, and deleting or wiping data outright. Screenshots in particular can expose a target’s contacts, conversations, schedule, location and daily routines, which explains why they feature so heavily in the toolkit. The advisory adds that personal information from earlier victims has surfaced on pro-Iranian leak sites, a detail that raises the stakes around harassment and safety for anyone caught up in the campaign. Stolen material is exfiltrated through Telegram bots or cloud storage providers, including VultrObjects and StorjShare. ## What defenders should watch for The joint advisory lists several network indicators worth investigating, particularly when connections do not match normal business activity: api.telegram.org, backblazeb2.com, vultrobjects.com, storjshare.io, iproyal.com and lightningproxies.net. Security teams supporting journalists, activists or other high-risk individuals are urged to extend monitoring beyond managed corporate devices, since the campaign is explicitly designed to exploit that blind spot. Recommended hunting steps include checking for unexpected Registry Run-key entries, unusual Microsoft Defender exclusions, Telegram-linked network traffic, and executables sitting in nonstandard directories. For individuals, the guidance is more basic but still effective: avoid installing software sent through unsolicited attachments or messaging links, download applications only from official vendor sites or trusted app stores, keep Windows and security tools up to date, and treat Windows SmartScreen warnings as a signal worth stopping for rather than clicking past.