Iranian State-Backed Hackers Deploy Surveillance Malware via Social Messaging Apps Western intelligence agencies including the FBI, the UK’s National Cyber Security Centre (NCSC), and the Netherlands’ AIVD have issued a joint warning about Iranian state-sponsored cyber actors targeting individuals with Chosen Brick, a Windows-based malware designed for surveillance and data theft. Active since at least 2025, the campaign primarily focuses on dissidents, activists, and journalists perceived as threats to the Iranian regime. In some cases, intelligence services have reportedly plotted kidnappings or lethal operations against targeted individuals abroad. ### Attack Methodology The operation begins with social engineering via WhatsApp and Telegram, where attackers impersonate trusted contacts or organizations. Extensive reconnaissance ensures messages appear credible, leveraging detailed knowledge of the victim’s network and affiliations. Once rapport is established, victims are tricked into downloading malicious files disguised as legitimate applications, including: - Pictory - RunwayML - Norton Antivirus - Telegram - Adobe Flash Player - KeePass Upon execution, Chosen Brick silently infects the system, persisting through reboots by modifying the Windows registry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`). It evades detection by adding exclusions to Microsoft Defender and uses Telegram bots for command-and-control (C2) communications. ### Malware Capabilities - Data theft: Contacts, emails, and social media messages (WhatsApp/Telegram via browsers). - Surveillance: Screen and audio capture, system enumeration. - Persistence: Downloads additional payloads and maintains access. - Destruction: Can wipe the infected system. While lateral movement across networks hasn’t been observed, agencies note it remains technically feasible. ### Broader Context The alert follows a surge in critical infrastructure attacks linked to Iran, including: - July 2024: Cyberattacks on 100+ U.S. water utilities across 12 states (CISA did not formally attribute the incidents). - August 2024: A suspected Iran-linked attack shut down a UK power plant. - AI-driven exploits: U.S. agencies warned of attackers using AI-generated scripts to target Siemens S7 PLCs in water, energy, and manufacturing sectors. The advisory underscores Iran’s use of cyber operations to suppress dissent and disrupt critical services, with personal and corporate devices both at risk.

Zero-Day Privilege-Escalation Flaw in Avast Antivirus Exposed via Public PoC Security researcher Chaotic Eclipse (GitHub handle: MSNightmare) has released a public proof-of-concept (PoC) exploit, dubbed PrettyPrague, for a zero-day privilege-escalation vulnerability in Avast Antivirus. The flaw affects fully patched Avast installations on Windows 11 25H2 systems, allowing attackers to bypass security controls via the Avast Sandbox a component designed to isolate suspicious files. The exploit targets the Windows Security Account Manager (SAM) database, enabling attackers with existing code execution on a system to escalate privileges to NT AUTHORITY\SYSTEM the highest local security context in Windows. From there, adversaries could access protected credentials, disable security tools, install persistent malware, or modify critical OS settings. The PoC, published on GitHub, includes C/C++ source files, compiled x64 binaries, and a library (offreg.lib) to dump the SAM database and spawn a SYSTEM-level command shell. While the repository claims compatibility with all Avast versions, this assertion remains unverified, as neither GenDigital (Avast’s parent company) nor a CVE identifier has confirmed the flaw. The researcher also speculated without evidence that other GenDigital products, such as AVG and Norton, may be affected. The repository was last updated on August 30, 2026, and its public availability raises concerns about potential misuse by threat actors. Security teams are advised to monitor GenDigital advisories, review endpoint telemetry for unusual activity (e.g., Avast services spawning privileged processes or unauthorized SAM access), and implement detection rules for suspicious execution chains involving antivirus sandbox components. As of now, no patch or official vendor response has been issued, leaving the report as an unverified but high-risk local privilege-escalation claim.

Iranian State-Linked Hackers Deploy CHOSEN BRICK Malware to Spy on Dissidents A joint advisory from the UK’s National Cyber Security Centre (NCSC), the FBI, and the Netherlands’ AIVD intelligence service has exposed a sustained cyberespionage campaign by Iranian state-linked hackers targeting dissidents, activists, journalists, and perceived regime critics. The operation, active since at least 2025, leverages a Windows malware family called CHOSEN BRICK to infiltrate systems and exfiltrate sensitive data. The malware has been deployed against individuals in the UK, United States, Netherlands, and other countries, with attackers using social engineering tactics to gain access. Initial contact occurs via WhatsApp, Telegram, and other messaging platforms, where threat actors pose as trusted contacts or technical support personnel. Victims are tricked into downloading malicious files disguised as legitimate applications such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass or as medical documents, including MRI scan results. Once executed, the malware displays a decoy interface while silently installing CHOSEN BRICK in the background. It establishes persistence by modifying the Windows Registry Run key and evades detection by adding Microsoft Defender exclusions. Command-and-control communications are routed through unique Telegram bot IDs, blending malicious traffic with legitimate Telegram API calls. The malware can also use HTTPS or SOCKS5 proxies to obscure its activity. CHOSEN BRICK is capable of extensive surveillance, including: - Stealing emails, social media messages, and contacts - Capturing screenshots and audio recordings - Harvesting Telegram and WhatsApp web data - Enumerating running processes and system details - Downloading additional malware - Deleting or wiping compromised systems Exfiltrated data is transmitted via Telegram bots and cloud-storage services, including VultrObjects, StorjShare, Backblaze B2, and proxy providers like IPRoyal and LightningProxies. Investigators are advised to monitor connections to these domains and scrutinize unexpected Run-key entries or unusual messaging-platform traffic. The campaign aligns with Iran’s broader strategy of using cyber operations to monitor, intimidate, and harass critics abroad. In past incidents, stolen personal data has been leaked on pro-Iranian websites, amplifying risks to victims’ privacy and safety. The advisory underscores the persistent threat posed by state-sponsored actors exploiting digital platforms for targeted espionage.

Gen Digital, previously Symantec Corporation, and NortonLifeLock, alerted its clients to the fact that threat actors had compromised Norton Password Manager accounts through credential-stuffing assaults. The company stated that while none of its systems had been penetrated, the attack may have utilized credentials that came from another source. NortonLifeLock has not yet made public how many customers are affected. Threat actors could have accessed Password Manager accounts and seen information such as first and last names, phone numbers, and mailing addresses. NortonLifeLock has announced the adoption of additional security measures for the affected accounts and reset Norton passwords on those accounts in response to the incident.

The Vermont Office of the Attorney General reported on January 9, 2023, that NortonLifeLock Gen Digital experienced a data breach, where unauthorized third parties likely accessed customer usernames and passwords for accounts created before December 1, 2022. The breach began around December 1, 2022, and potentially exposed customer first names, last names, phone numbers, and mailing addresses. The number of affected individuals is currently unknown.

Identity theft protection firm LifeLock have exposed customers to additional attacks from ID thieves and phishers. The company just fixed a vulnerability on its site that allowed anyone with a Web browser to index email addresses associated with millions of customer accounts, or to unsubscribe users from all communications from the company.