Medical results are becoming part of a highly targeted malware lure. Iranian state cyber actors are disguising CHOSEN BRICK spyware as MRI files and familiar software to compromise Windows PCs.
The UK’s National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service warned Sept. 15, 2026, that the campaign has targeted dissidents, activists, and journalists in the UK, US, and Netherlands since at least 2025. Once installed, CHOSEN BRICK can collect emails, messages, screenshots, microphone audio, and other sensitive data.
The attackers may also move from corporate to personal devices when an initial delivery attempt fails or risks detection. The joint government advisory says this can help them evade security controls protecting managed endpoints.
Fake MRI files hide a Windows surveillance implant
Operators research prospective victims, then approach them over WhatsApp or Telegram while posing as trusted contacts or messaging-platform support. The malicious file is tailored to fit the conversation.
Observed lures include fake MRI results and counterfeit versions of Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The tactic resembles other campaigns that abuse trusted software and familiar workflows to lower suspicion.
Opening the file displays a legitimate-looking decoy while CHOSEN BRICK runs in the background. Other phishing operations have similarly used legitimate services to deliver malware and bypass reputation-based defenses.
For persistence, CHOSEN BRICK uses the current user’s Windows Registry Run key, allowing it to execute again at logon. It can also add Microsoft Defender exclusions to evade detection.
The spyware can enumerate processes and system information, take screenshots, record microphone audio, steal email content, and copy Telegram and WhatsApp data from browsers. It uses Telegram for command and control, while newer variants have used HTTPS and SOCKS5 proxies to obscure traffic.
The agencies have not observed automated lateral movement, although the malware can download additional payloads. Stolen data can expose contacts, locations, and patterns of life, and the Dutch AIVD says identified victims in the Netherlands have been notified.
Personal devices complicate detection and response
Known indicators can help investigators, but CHOSEN BRICK also relies on social engineering and legitimate online services. Organizations should combine preventive controls, behavioral monitoring, and tested response procedures.
- Limit untrusted software execution. Require software from legitimate sources and use application allowlisting on managed Windows devices.
- Maintain endpoint protections. Patch Windows and applications, keep antivirus and Microsoft SmartScreen enabled, and use phishing-resistant multifactor authentication where possible.
- Monitor persistence and security changes. Alert on suspicious Registry Run-key entries and unexpected Microsoft Defender exclusions.
- Hunt unusual network activity. Investigate unexpected Telegram API, cloud-storage, and proxy connections without treating legitimate service use as proof of compromise.
- Reduce unmanaged-device exposure. Limit sensitive corporate access from personal or noncompliant systems and strengthen protections for high-risk personnel.
- Preserve telemetry and hunt behaviorally. Retain endpoint, DNS, proxy, authentication, and Windows logs; recent investigations show why tracking behavior across the attack chain remains useful when infrastructure changes.
- Test incident response plans. Exercise endpoint compromise, personal-device escalation, credential exposure, persistence, and communication with affected employees.
Organizations that suspect CHOSEN BRICK execution should involve security teams and search available logs using published indicators and detection signatures. Blocking a payload on a corporate laptop may not end the attack if the operator can persuade the same target to move to a less-protected personal PC.
Read more: Trusted brands can also become part of malware delivery, as a recent campaign showed when attackers used malicious ads to push ClickFix malware to Windows and Mac users.
.