Western intelligence warns of Iranian cyber threats targeting dissidents

What the report says

Western intelligence agencies in the United States, Britain and the Netherlands have issued a coordinated warning that Iran-linked spyware is being used to target dissidents and other critics of the Iranian government living abroad. The advisory, reported by Al Jazeera and dated September 15, 2026, says the cyber activity is aimed at stealing information from people in the West who oppose Tehran.

The FBI, Britain’s National Cyber Security Centre and the Netherlands’ AIVD all said Iran is “almost certainly” carrying out such operations. Britain’s cyber agency said the campaign shows how Iranian actors use digital surveillance to repress critics, including by taking emails and messages and gaining access to devices. The agencies pointed to a spyware family called CHOSEN BRICK, which they say has been associated with state-linked Iranian hackers.

According to the warning, the malware is spread through spear-phishing efforts on messaging platforms such as WhatsApp and Telegram. The FBI said Iran’s Ministry of Intelligence and Security uses the tools to collect intelligence, leak data and damage the reputations of targeted individuals. The article also notes that this is part of an ongoing pattern of Western warnings about Iranian attempts to reach dissidents abroad.

Al Jazeera said earlier warnings have linked similar activity to a persona called Handala Hack. The new advisories come amid broader concern in Western capitals about state-backed cyber operations against critics, activists and exiles.