UK, US, and Dutch Agencies Warn Iran is Using Spyware to Target Dissidents Abroad

Intelligence agencies from the UK, US, and the Netherlands issued a warning on Tuesday, revealing that Iranian government spyware is being used to surveil dissidents, activists, and journalists across messaging platforms such as WhatsApp and Telegram.

Britain's National Cyber Security Centre stated that the cyber actors employed a spyware family known as Chosen Brick to extract emails, messages, and sensitive data through targeted spear-phishing campaigns. Paul Chichester, NCSC Director of Operations, emphasized that the campaign demonstrates how Iran utilizes digital surveillance to repress regime critics by stealing communications and compromising devices.

The Iranian embassy in London did not immediately respond to requests for comment regarding the allegations.

According to the advisory, the malware is capable of gathering data from contact lists, email accounts, and social media profiles, alongside capturing screen contents and activating microphones. The NCSC noted that victims' personal information subsequently surfaced on pro-Iranian leak sites.

Attackers frequently impersonated trusted contacts on messaging applications, customizing their strategies for individual targets. Tactics included deploying fabricated documents and forged MRI test results to trick victims into downloading the malicious software.

The NCSC, alongside the FBI and the Netherlands' AIVD intelligence service, concluded that Iran almost certainly leverages cyber operations to suppress perceived threats. This follows joint statements last year from the UK, US, France, and over a dozen other nations condemning an increase in assassination, kidnapping, and harassment plots orchestrated by Iranian intelligence against individuals in Europe and North America.

The UK government has previously disclosed that it disrupted more than 20 Iran-linked plots targeting individuals within the country since 2022, encompassing both British citizens and others viewed as threats by Tehran.