Chosen Brick campaign described as targeting Windows users with surveillance malware
SecurityUnverifiedUpdated:
An advisory warns that alleged Iranian state actors are using Chosen Brick for surveillance and data theft on Windows devices. The reported campaign targets individuals through messaging apps and installs malware that persists across restarts.
Lures impersonating trusted contacts and legitimate apps
According to the report, Iranian state cyber actors use messages on WhatsApp and Telegram that appear to come from trusted contacts or organizations. Victims are reportedly persuaded to open files disguised as legitimate applications, including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The warning says Chosen Brick can persist after reboot, seek to evade Microsoft Defender, communicate through a victim-specific Telegram bot, download additional malware, collect device and communications data, capture screen and audio content, and wipe a computer.
The advisory describes a Windows-only campaign that uses impersonation of trusted contacts and legitimate apps to lure targets into infection.
A joint warning now describes Chosen Brick as an active, Windows-focused malware campaign attributed to Iranian state cyber actors, targeting individuals through social messaging apps.
The reported activity is directed at personal devices as well as corporate ones, and the warning connects it to the surveillance of dissidents, activists, and journalists. Its reported use of familiar messaging services and application disguises shows how targeted social engineering can precede device compromise.
Sources
- The RegisterIranian spies hit Windows machines with Chosen Brick data-stealing malwareRead source →