US, UK, Netherlands warn Iran spyware targets dissidents abroad

September 16, 2026 at 01:16 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The United States, Britain and the Netherlands warned on Tuesday that Iran is almost certainly using cyber operations to target Iranian critics abroad. The FBI, NCSC and AIVD issued coordinated advisories describing a spyware family known as CHOSEN BRICK used to steal emails and messages from dissidents. The warning follows a March attack attributed to Iran-linked hackers that crippled medical device maker Stryker.

Key Facts

The FBI, Britain's NCSC and the Netherlands' AIVD issued coordinated advisories on Tuesday warning that Iran is almost certainly using cyber operations to target Iranian critics abroad.
The spyware family CHOSEN BRICK is allegedly used by Iranian state-linked actors to steal sensitive information through spear-phishing on WhatsApp and Telegram.
The FBI said Iran's Ministry of Intelligence and Security uses the malware to collect intelligence, conduct data leaks, and inflict reputational harm.
A March attack attributed to Iran-linked hackers crippled the global networks of Stryker, one of the world's largest medical device companies.
The Handala Hack persona claimed responsibility for the Stryker attack and said it marked the beginning of a new chapter in cyber warfare.

Coordinated Western Warning

The FBI, Britain's National Cyber Security Centre and the Netherlands' AIVD intelligence service issued coordinated advisories on Tuesday. The agencies warned that Iran is almost certainly using cyber operations to target Iranian critics of the regime living in the West. Paul Chichester, director of Britain's NCSC, said the campaign reveals how Iran ruthlessly uses digital surveillance to repress critics, stealing emails and messages and accessing devices. The FBI stated that Iran's Ministry of Intelligence and Security uses the malware to collect intelligence, conduct data leaks, and inflict reputational harm against targets.

CHOSEN BRICK Spyware

Chichester highlighted a spyware family known as CHOSEN BRICK that is allegedly used by Iranian state-linked cyber actors. The malware steals sensitive information through spear-phishing campaigns on messaging platforms including WhatsApp and Telegram. The advice continues regular warnings by Western intelligence over Iran's efforts to target dissidents abroad. In March, the FBI described alleged MOIS efforts to use the malware to collect data on targets that was then posted online by a persona known as Handala Hack.

Handala Hack Campaign

The March attack crippled the global networks of Stryker, one of the world's largest medical device companies. An Iran-linked hacking group claimed responsibility and warned it marked the beginning of a new chapter in cyber warfare. The Handala hackers also claimed to have gained access to the personal emails of Kash Patel, director of the FBI, sharing photographs and documents online. In July, US officials said a cyberattack on water systems in Minnesota resembled the Handala Hack.