CHOSEN BRICK Turns Trusted Chats Into a Surveillance Channel for Iranian Operators

A joint warning from United States, United Kingdom, and Dutch agencies has exposed CHOSEN BRICK, a Windows malware family used by Iranian state-linked operators to monitor dissidents, activists, and journalists worldwide.

Details reported on September 16, 2026 describe a campaign active since at least 2025. Rather than exploiting a software vulnerability, the operators manipulate victims through WhatsApp and Telegram, impersonating trusted contacts or support personnel before delivering malicious files.

Once installed, CHOSEN BRICK can steal communications, capture screenshots, record microphone audio, deploy additional malware, and destroy data. The consequences may extend beyond the compromised computer: stolen information has appeared on pro-Iranian leak sites and could facilitate harassment, tracking, or physical targeting.

Attackers Move From Corporate Controls to Personal Devices

The operation begins with reconnaissance and direct contact. Attackers approach prospective victims through WhatsApp or Telegram using identities designed to make an unexpected file appear credible.

They may pose as acquaintances, trusted contacts, or technical-support representatives. The objective is not simply to obtain a click, but to build enough confidence that the target will launch an application or open a purported document.

Observed lures have impersonated:

• Pictory.
• RunwayML.
• Norton Antivirus.
• Telegram.
• Adobe Flash Player.
• KeePass.
• Medical documents, including supposed MRI scan results.

The malicious file displays an interface consistent with the promised application or document. Meanwhile, CHOSEN BRICK installs and begins operating in the background. This decoy reduces the chance that victims will recognize the compromise and immediately report it.

The operators also adapt when enterprise defenses intervene. Contact may begin on a corporate device, but if security controls block execution, the attacker tries to shift the exchange to the victim’s personal Windows computer.

That move creates a significant defensive gap. Personal systems may lack application allowlisting, centralized logging, endpoint detection, and the monitoring available on managed corporate equipment. It also means an organization cannot treat a blocked attachment as the end of an incident.

Registry Persistence and Defender Exclusions Keep the Implant Running

Every observed CHOSEN BRICK infection involved Microsoft Windows, according to the joint-agency reporting on the campaign. Exact affected Windows versions have not been disclosed.

After execution, the malware creates persistence through Windows Registry Run keys, allowing it to restart when the user logs in or the computer reboots. Defenders should therefore examine Run locations for recently created values pointing to unusual executables, user-writable directories, or unexpected system paths.

CHOSEN BRICK also adds Microsoft Defender exclusions. These changes can prevent local antivirus scanning from examining selected files, folders, processes, or locations used by the malware.

A Defender exclusion is not inherently malicious, since administrators and legitimate applications sometimes create them. Context matters. A new exclusion becomes substantially more suspicious when it coincides with a recently downloaded installer, an unsolicited messaging conversation, or a new Registry Run entry.

The malware then connects the infected endpoint to Telegram-based command-and-control infrastructure. Each infection reportedly receives a unique Telegram bot or bot identifier associated with that victim. This separation helps operators manage targets individually and reduces the risk of commands or stolen data crossing between operations.

There is no reported automated lateral-movement capability. However, CHOSEN BRICK can retrieve additional payloads, enabling operators to expand access manually after the initial infection.

Telegram, Cloud Storage, and SOCKS5 Proxies Carry the Traffic

Telegram serves two roles in the campaign: it is an initial social-engineering channel and part of the malware’s command-and-control infrastructure. The malware can also use it to transfer collected data.

Additional exfiltration and operational infrastructure includes:

• Backblaze B2.
• VultrObjects.
• StorjShare.
• IPRoyal.
• LightningProxies.
• The Telegram API.

Newer CHOSEN BRICK variants reportedly route connections through SOCKS5 proxies, obscuring the direct relationship between an infected endpoint and attacker-controlled activity.

Connections to these services are not sufficient, on their own, to establish an infection. Several provide legitimate cloud storage or network services. Defenders should correlate them with endpoint evidence such as suspicious persistence, archive creation, browser-database access, screenshot capture, microphone use, or unusual file reads.

Traffic to Telegram infrastructure deserves particular scrutiny on systems whose users do not ordinarily require it. Security teams should also look for bot-driven communications and repeated encrypted outbound connections that begin soon after an unfamiliar executable is launched.

The reported secondary-payload destination is:

C:\Windows \SysWOW64

The published path contains a space between Windows and \SysWOW64. Investigators should preserve that exact string while also determining whether the spacing represents a genuine filesystem indicator or a formatting artifact. Searches should account for both possibilities rather than silently normalizing the path.

Surveillance Can Escalate Into Data Destruction

CHOSEN BRICK combines intelligence collection with disruptive functionality. Its reported capabilities include collecting system information, enumerating processes, taking screenshots, and recording audio through the computer’s microphone.

It can also target communications stored through browsers, including:

• Email content.
• Telegram browser data.
• WhatsApp browser data.
• Other browser-stored communications information.

The malware can download and execute secondary payloads, giving operators a mechanism to introduce capabilities not present in the original implant. This means an initial detection should not be scoped only around CHOSEN BRICK artifacts; responders must also search for follow-on tools and commands.

Destructive options include deleting files, executing data-removal commands, and wiping the entire infected host. There is no disclosed CVSS score because this is a malware campaign rather than a vulnerability assigned a CVE.

The threat is especially severe because the collected material can affect physical safety. Iranian intelligence services have, in some cases, been assessed as planning kidnapping or lethal operations against perceived regime enemies abroad. Information taken from a device could expose locations, personal relationships, communications, travel plans, or the identities of other at-risk people.

Stolen personal information has also been published on pro-Iranian leak sites, reportedly to intimidate and harass victims. For politically exposed targets, incident response must therefore consider more than restoration of the computer.

Detection Should Correlate Messaging, Endpoint, and Network Evidence

Security teams should first review Windows Registry Run locations and Microsoft Defender exclusions. Newly created entries should be correlated with messaging activity, file downloads, user logons, and process execution.

Network monitoring should search for unexpected access to the Telegram API, Backblaze B2, VultrObjects, StorjShare, IPRoyal, and LightningProxies. Analysts should investigate SOCKS5 use from endpoints without a documented business requirement.

Useful endpoint detection priorities include:

• Unusual microphone access.
• Automated screenshot capture.
• Access to browser databases or communications stores.
• Process enumeration by an unfamiliar binary.
• Downloads into Windows system directories.
• Suspicious child processes launched by recently downloaded applications.
• Commands that delete files or prepare a host for wiping.
• Defender exclusions covering user-writable or staging directories.

Investigators should compare corporate and personal device timelines where possible. A blocked delivery on a managed system followed by a request to continue the conversation on a personal device is a particularly relevant pattern.

Organizations should also obtain the additional indicators published with the joint warning and apply them across endpoint, firewall, proxy, DNS, cloud, and identity telemetry. The publicly reported infrastructure names are starting points, not a complete detection set.

Response Must Protect Both Systems and People

Potential victims should not launch installers or medical files delivered through unsolicited WhatsApp or Telegram conversations, even when the sender appears familiar. Verification should occur through a separate, previously trusted communication channel.

Organizations supporting journalists, activists, and dissidents should apply execution controls to block unapproved installers and utilities. High-risk personnel need equivalent protection on personal devices when those systems are used during work-related or sensitive conversations.

For suspected infections, responders should:

1. Preserve forensic evidence before deleting files or changing persistence.
2. Isolate the affected endpoint using a method that does not alert the operator unnecessarily.
3. Review Registry Run entries and Defender exclusions.
4. Identify Telegram, cloud-storage, and proxy communications.
5. Search for secondary payloads and destructive commands.
6. Reset exposed credentials through a known-clean device.
7. Rebuild compromised systems where integrity cannot be established.
8. Restore data only from tested, protected backups.

Response planning should include secure communications outside the affected device. Where a victim faces political or physical danger, organizations may also need to coordinate with appropriate authorities and personal-security specialists.

CHOSEN BRICK is not merely a credential stealer. The reported combination of surveillance, payload delivery, and host wiping gives its operators both intelligence-gathering and coercive options—and makes rapid, discreet investigation essential.