Western Intelligence Agencies Issue Coordinated Warning Over Iranian Spyware Targeting Dissidents

Intelligence services across the United States, the United Kingdom, and the Netherlands have issued a joint advisory warning that Iranian state-linked cyber operators are deploying dangerous spyware against dissidents and political critics residing throughout the Western world.

The coordinated alert highlights an aggressive, sustained campaign by Tehran to surveil and silence opponents living in exile. According to the collaborative intelligence assessment released on Tuesday, the Iranian state is “almost certainly” conducting targeted digital espionage operations aimed directly at critics who challenge the ruling regime from abroad.

The synchronized warning represents an aligned effort among major security and intelligence bodies across three allied nations. The alert was issued jointly by the Federal Bureau of Investigation (FBI) in the United States, the National Cyber Security Centre (NCSC) in the United Kingdom, and the General Intelligence and Security Service (AIVD) in the Netherlands, all of which released matching assessments detailing the nature of the cyber threat.

Central to the joint advisory is the identification of a specific malware family known as “CHOSEN BRICK.” Intelligence officials reported that this specialized spyware has been actively utilized by Iranian state-linked threat actors seeking to compromise personal devices and harvest sensitive user data.

According to Western cyber authorities, the operators behind the CHOSEN BRICK framework rely heavily on spear-phishing campaigns to deliver the malicious software to prospective victims. These operations primarily target individuals across popular direct communication and messaging platforms, with intelligence agencies specifically highlighting activity occurring on Telegram and WhatsApp.

Paul Chichester, the director of Britain’s NCSC, emphasized the severe nature of the digital surveillance offensive. He stated that the operational specifics of the campaign expose how the Iranian regime ruthlessly leverages digital surveillance to repress political critics, unlawfully infiltrating personal devices to siphon off private email correspondence and messaging records.

In its accompanying assessment, the FBI pointed directly to Iran’s Ministry of Intelligence and Security (MOIS) as the state entity responsible for overseeing the deployment of the malware. The American bureau indicated that the Iranian intelligence apparatus has weaponized these digital capabilities against selected individuals across foreign jurisdictions.

United States officials explained that the MOIS does not limit its use of the malicious software to quiet intelligence collection. In addition to harvesting private records, the ministry utilizes the malware to orchestrate targeted data leaks and deliberately inflict severe reputational harm on dissidents and opposing figures.

The latest joint security notice marks the continuation of an ongoing series of public warnings from Western intelligence services regarding Iranian digital aggression. Officials have repeatedly raised alarms over Tehran’s efforts to extend its domestic suppression tactics abroad by tracking, intimidating, and neutralizing dissidents living in foreign countries.

The current findings build directly upon earlier intelligence releases published earlier this year. In an advisory published in March, the FBI described how the MOIS employed malware to collect information on designated targets and subsequently leaked the compromised data across the internet under an online persona known as “Handala Hack.”

The broader digital offensive tied to Iranian threat actors has also spilled over into critical commercial sectors. During that same period in March, an expansive cyber incident crippled the worldwide computer networks of Stryker, which ranks as one of the world’s largest medical technology and device manufacturing corporations.

Following the devastating disruption to Stryker's global operations, an Iran-aligned cyber group claimed responsibility for the assault. In its public statement claiming the breach, the group warned that the attack marked the formal beginning of a new era in state-linked cyber warfare.

The Handala hacking persona has also asserted that it compromised high-ranking government officials in the West. The collective claimed to have breached the personal email accounts of FBI Director Kash Patel, subsequently publishing personal photographs and private documents belonging to the American law enforcement leader on the internet.

Furthermore, state-linked cyber intrusions have increasingly intersected with critical public utilities. In July, United States officials revealed that a disruptive cyberattack directed at municipal water systems in the state of Minnesota bore striking resemblances to the methods and signatures associated with the Handala Hack persona.

As security services continue to monitor state-backed threat groups, the joint advisory from Washington, London, and The Hague underscores the persistent risks facing overseas dissidents. Intelligence officials advise that the threat posed by Tehran's digital surveillance apparatus remains an active and urgent concern for political critics and diaspora communities across the globe.