Britain, the United States and the Netherlands yesterday issued a joint cybersecurity advisory detailing spyware they say is used by Iranian state-linked actors to target dissidents, activists and journalists.
Britain’s National Cyber Security Centre said Iranian state-linked cyber actors had used a spyware family known as ‘CHOSEN BRICK’ to steal emails, messages and other sensitive information through ‘spear-phishing’ campaigns on messaging platforms including WhatsApp and Telegram.
“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” Paul Chichester, NCSC director of operations, said in a statement.
Iran’s embassy in London did not immediately respond to a request for comment.
The malware, according to the advisory, can collect information from contact lists, emails and social media accounts, capture screen content and access a device’s microphone. The NCSC said some victims’ personal details had later appeared on pro-Iranian leak sites.
The FBI, in its own advisory, said Iran’s Ministry of Intelligence and Security (MOIS) was using the malware to “collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets.”
The FBI declined to share additional details on how many people have been targeted with the malware, or where they’re located.
The NCSC said the attackers often posed as trusted contacts on messaging apps and tailored their approach to individual targets. In some cases, it said, they used fake documents, including fabricated MRI test results, to persuade victims to download the malware.
The NCSC, alongside the FBI and the Netherlands’ AIVD intelligence service, said Iran ‘almost certainly’ uses cyber operations to help suppress people it sees as threats.
The FBI’s advisory said it was an update to a March 2026 warning describing alleged MOIS efforts to use the malware to collect data on targets, which was then posted online by a hacking persona known as ‘Handala Hack’.
Handala has targeted multiple US companies and people since the start of the Iran war, including a destructive cyberattack against Michigan-based medical supplies and services supplier Stryker in March, and the leak of FBI Director Kash Patel’s personal emails later that month.
Handala did not respond to an emailed request for comment.
Meanwhile, Congress’ nonpartisan bookkeeper reported that the six-month-old US-Iran war has cost $38 billion so far and that amount is projected to rise by $3bn a month, as the Trump administration searches for ways to end the conflict and reopen the vital Strait of Hormuz.
The war is expected to increase inflation by 0.5 per cent in the first three months of 2027, according to the Congressional Budget Office accounting, which totaled expenses through August 1.
The mounting costs have strained US munitions stockpiles and driven up energy prices, raising concerns about the country’s ability to respond to other potential conflicts and adding pressure on an already stretched federal budget.
The cost was close to the $37.5bn that Defence Secretary Pete Hegseth reported at a Senate hearing on July 21.
The budget office said the majority of the costs stem from the rapid drawdown of munitions, estimating that it could take five years to replenish US stockpiles. Reuters reported in August that the US had used ‘virtually all’ of its long-range precision missiles during the war.
The Department of Defence did not co-operate with congressional financial auditors, CBO reported.
Representatives from the White House and Department of Defence did not immediately respond to requests for comment.
The inquiry was conducted at the request of the top Democrat on the US House of Representatives Budget Committee, Brendan Boyle of Pennsylvania.
“Donald Trump’s disastrous war in Iran has already taken the lives of brave American servicemembers and left others wounded,” Boyle said in a statement.
&uuid=(email))