CHOSEN BRICK Spyware: Iran’s Bricks Finally Went Digital
Why CHOSEN BRICK Proves Tehran’s Secret Police Finally Discovered Remote Work
Iranian intelligence has allegedly entered the exciting world of digital transformation, after Western intelligence agencies warned that state-linked cyber operators are using malware known as CHOSEN BRICK against dissidents, activists and journalists abroad.
The warning was issued by cybersecurity and intelligence agencies in the United States, United Kingdom and Netherlands. Britain’s National Cyber Security Centre says CHOSEN BRICK can collect contacts, emails and social media messages, capture screen content and access microphones on infected Windows computers. Which offers a very literal window into someone’s life, assuming windows still count once they have been rebranded as Windows.
Which raises the obvious question. Whatever happened to the brick?
CHOSEN BRICK: Government Oppression Finally Gets Bluetooth
There was a time when government intimidation required craftsmanship. You selected a brick. You wrote something unpleasant on it. You found the dissident’s window. You threw. Everybody understood the transaction. Now, apparently, the brick has Bluetooth.
Government oppression, like banking and airline check-in, has become an app. The principal advantage of CHOSEN BRICK is obvious. Unlike the traditional brick, it does not remain on the carpet surrounded by shattered glass, with fingerprints and the words PROPERTY OF MINISTRY OF INTELLIGENCE accidentally stamped on one side. Progress. The brick has graduated from breaking windows to hacking Windows.
Western agencies say targets can be approached through messaging services including WhatsApp and Telegram, with attackers impersonating people they trust before persuading them to open malicious files. So authoritarianism has finally discovered customer relationship management. Tehran isn’t kicking down doors anymore, it’s WhatsApping its way through them.
How CHOSEN BRICK Gets Past Your WhatsApp, One Fake Old Friend At A Time
Imagine fleeing your country because you fear government surveillance. Moving four thousand miles away. Changing your telephone number. Buying new curtains. Adopting a Labrador. Finally sitting down with a cup of coffee in Manchester.
Ping. WhatsApp. “Hello old friend, remember me from university?” You have not heard from him since 2009. “Please open attached document.” Suddenly you are thinking, that sounds normal. The attachment is called Definitely_Not_Iranian_Spyware_FINAL2.pdf.exe.
Western officials say attackers research targets, establish credibility and sometimes disguise malicious files as legitimate documents, including, according to cybersecurity outlet The Record, files presented as MRI scan results.
That is modern espionage. James Bond had Aston Martins, martinis and a supporting cast. Now international intelligence operations apparently involve convincing somebody to download a neurological scan. We have gone from “Mr Bond, I’ve been expecting you” to “hi, just circling back on the attachment.” Operators reportedly spend days building rapport before making a move, which in dating circles is called taking it slow, and in intelligence circles is called the same thing, minus the flowers.
Soon spies will have LinkedIn. Ayatollah Intelligence Operative. Cybersecurity, Stakeholder Surveillance, Dissident Engagement, Reputation Management. “Thrilled to announce that after three exciting years monitoring journalists, I have accepted a new opportunity in Expatriate Intimidation.” And naturally everybody will congratulate him.
CHOSEN BRICK And The Long, Tedious Search For A Happy Iranian Dissident
The FBI says Iran’s Ministry of Intelligence and Security has used CHOSEN BRICK to gather intelligence, leak data and damage the reputations of its targets, according to a joint statement reported by Al Jazeera.
This means someone may potentially spend hours reading private conversations between Iranian government critics, which seems an unnecessarily elaborate way of discovering that Iranian government critics are critical of the Iranian government.
Imagine assigning forty intelligence officers to uncover this. After six months of surveillance. “Supreme leadership, we have extraordinary information.” “What?” “The dissident does not like us.” “My God.” “We also discovered his cousin doesn’t like us.” “Impossible.” “And there’s an aunt in Rotterdam who sent a thumbs down emoji.” “Activate the emergency committee.”
This is the intelligence equivalent of breaking into a chef’s house to determine whether he has opinions about cooking. The surveillance programme presumably keeps searching nevertheless, hoping somewhere among millions of messages to uncover the elusive communication. Dear Hassan, government doing fantastic, no complaints whatsoever, five stars, would recommend. Regards, a completely satisfied dissident. At which point Iranian intelligence would face its greatest challenge yet: identifying the obvious infiltrator.
CHOSEN BRICK Proves The Secret Police Have Discovered Remote Working
The larger comic achievement here is geographical. The NCSC assessment says CHOSEN BRICK has been used against people around the world, including targets in Britain, America and the Netherlands. The agency assesses that Iranian cyber activity is being used against people considered threats by Iranian authorities.
Traditionally, if somebody emigrated, repression became inconvenient. There were borders. Airfare. Hotels. Expense accounts. Some poor intelligence officer had to fly to Amsterdam and spend three miserable February days sitting inside a rented Peugeot watching an apartment.
Now? Teams. Zoom. Malware. Repression has discovered telecommuting. A manager can presumably begin the morning meeting like this. “Reza, you’re covering London.” “Yes.” “Farhad, Amsterdam.” “Yes.” “Mahmoud?” “Toronto.” “Excellent. Nobody leave the building.” You can almost hear the productivity consultants applauding. The whole thing represents a genuine breakthrough in authoritarian efficiency, since the dissident can leave Iran without forcing Iranian intelligence to endure the inconvenience of leaving Iran.
CHOSEN BRICK Chases Dissidents Around The Globe Like An Overly Attached Ex
There is something inherently awkward about needing an international cyber operation to monitor people who have already left. It is the geopolitical equivalent of a restaurant owner chasing dissatisfied customers three blocks down the street demanding to know why they are not enjoying dinner. “You left.” “Yes.” “Why?” “This conversation is rapidly clarifying the issue.”
The dissident moves to London. The government follows electronically. The dissident moves to Amsterdam. Ping. The dissident moves to Chicago. Ping. Eventually the man is standing in Antarctica beside a penguin when his telephone vibrates. Unknown Iranian Contact: “Hello dear friend, long time, please urgently open this MRI.” Even the penguin knows not to click it.
Why CHOSEN BRICK Is The Best Named Malware In Iranian Intelligence History
There is also the name. CHOSEN BRICK. That is outstanding government branding. It sounds less like spyware and more like a building material selected by a very emotional architect. “We considered Oxford Sandstone, Georgian Red and Imperial Clay, but ultimately the committee selected Chosen Brick.” Why chosen? Chosen by whom? Was there a competition? Were other bricks eliminated? Brick Number One performs malware, judges turn around, “I choose you.” Suddenly the brick gets a government pension.
According to the NCSC, CHOSEN BRICK can persist after a Windows computer is rebooted, and can modify antivirus protections to help avoid detection. So even turning your computer off and back on again, humanity’s most successful technological solution since hitting the television, may not solve this one. Somewhere an IT department just lost its entire strategic doctrine. It is the kind of premise Milton Jones has built a career on, except this one comes with a state sponsor.
CHOSEN BRICK Has Better Customer Service Than Most Airlines
The modern spy no longer needs lock picks. He needs patience. He has to establish trust. He has to send messages. He has to convince the target to click. International espionage has gradually become indistinguishable from trying to sell somebody solar panels. “Hello sir, do you have a moment?” “No.” “This is concerning your recent medical scan.” “I didn’t have one.” “Excellent, please download it.” “No.” “Would Thursday be better?”
“Nothing says national security threat like a WhatsApp message from your mate Dave, who’s been dead since 2019,” said one Manchester based IT contractor who asked to be identified only as Kevin. His uncle, apparently unclear on the terminology, has taken to calling the whole affair digital espresso. And unlike normal spam, ignoring the first message presumably does not get you a follow-up reading LAST CHANCE, YOUR DISSIDENT SURVEILLANCE DISCOUNT EXPIRES MIDNIGHT.
CHOSEN BRICK: The Twenty-First Century Brick Nobody Asked For
Technology was supposed to make human beings freer. Instead humanity invented refrigerators that send emails, cars that require software updates, and now, according to Western intelligence agencies, spyware capable of turning computers into surveillance devices against political critics.
Still, one must acknowledge technological evolution. The old brick could break one window. The new brick can allegedly steal your contacts, read your messages, capture your screen and listen through your microphone. No dust. No broken glass. No angry homeowner standing in the driveway holding physical evidence. That is innovation. The brick did not disappear. It got an MBA.
And perhaps that is the great lesson of twenty-first century government bureaucracy. No institution ever truly abandons an old idea. It simply digitises it, gives it a frightening acronym, and produces a slide deck explaining how the brick is now cloud enabled. One target reportedly misheard the malware’s name as Bosen Chick and spent a confusing afternoon Googling poultry.
CHOSEN BRICK: One Serious Paragraph Before We Go Back To Bricks
For people genuinely at elevated risk, the NCSC recommends particular caution with unexpected files or links, especially messages relying on impersonation or manufactured trust. Its advisory provides technical detail and protective guidance, including specialised support for high risk individuals. Because sometimes the safest response to a mysterious message really is the cybersecurity technique your grandmother perfected years ago. Do not touch that.
The advisory behind all this was published on 15 September 2026 by Britain’s National Cyber Security Centre, the FBI and the Netherlands’ AIVD. NCSC Director of Operations Paul Chichester said the campaign shows how ruthlessly Iran uses digital surveillance to repress its critics abroad. CHOSEN BRICK targets Windows machines only, survives a reboot, and can disable antivirus protections, according to the joint advisory. Genuine lures documented by investigators included files disguised as antivirus software, VPN tools and fabricated MRI scan results.
Sources
- National Cyber Security Centre: joint advisory on CHOSEN BRICK
- The Record: Iranian cyber spies used fake MRI scans as a lure
- Al Jazeera: Western intelligence warns of Iranian cyber threats
This piece is British satire dressed up as UK satirical news, in the honourable tradition of English satirical journalism. Any resemblance between the penguin above and an actual penguin is entirely the fault of British humour.
For the American take on state sponsored bricklaying, visit Bohiney.com.
Auf Wiedersehen, amigo!
