Iranian government spyware snoops on dissidents, activists and journalists on messaging platforms including WhatsApp and Telegram, the UK, US and the Netherlands warned on Tuesday.
Britain's National Cyber Security Centre said the cyber actors had used a spyware family known as Chosen Brick to steal emails, messages and other sensitive information through “spear-phishing” campaigns.
“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” Paul Chichester, NCSC Director of Operations, said in a statement.
Iran's embassy in London did not immediately respond to a request for comment.
The malware can collect information from contact lists, emails and social media accounts, capture screen content and access microphones, the advisory warned. Some of the victims' personal details had later appeared on pro-Iranian leak sites, the NCSC said.
Attackers often posed as trusted contacts on messaging apps and tailored their approach to individual targets, the NCSC said.
This went so far as using fake documents and fabricated MRI test results to convince victims to download the malware.
The NCSC, alongside the FBI and the Netherlands' AIVD intelligence service, said Iran “almost certainly” uses cyber operations to help suppress people it sees as threats.
Last year, the UK, US and France were among more than a dozen countries to condemn what they called a surge in assassination, kidnapping and harassment plots by Iranian intelligence services against people in Europe and North America.
“We are united in our opposition to the attempts of Iranian intelligence services to kill, kidnap and harass people in Europe and North America in clear violation of our sovereignty,” the countries said.
The UK government previously said it had disrupted more than 20 Iran-linked plots to kidnap or kill people in the country since 2022, including British citizens and others Tehran views as threats.
