US, UK and Netherlands Expose the Secrets of Iranian Espionage
Britain, the United States and the Netherlands issued a joint warning on Tuesday about Iranian espionage targeting journalists and dissidents.
The tripartite warning provided details on “Iran-linked spyware programs” used to target dissidents, activists and journalists.
The UK’s National Cyber Security Centre said Iran-linked state actors had used a collection of spyware known as “Chosen Briar” to steal emails and other sensitive information through “spear-phishing” campaigns on messaging platforms, including WhatsApp and Telegram.
Paul Chichester, Director of Operations at the UK’s National Cyber Security Centre, said in a statement: “The details of this cyber campaign reveal how Iran is relentlessly using digital surveillance in pursuit of its objective of suppressing regime critics, stealing emails and messages, and compromising devices.”
The warning showed that the malware can collect information from contact lists, emails and social media accounts, capture screen content, and access the device’s microphone.
The center added that the personal data of some victims later appeared on Iran-aligned data-leak websites.
In its warning, the US Federal Bureau of Investigation (FBI) said Iran’s Ministry of Intelligence and Security uses the program “to collect intelligence, leak data, and damage the reputations of those it targets.”
The bureau declined to provide further details about the number of people targeted by the malware or where they were located.
The center said attackers often impersonate trusted contacts on messaging applications and tailor their approach to each individual target. In some cases, they used forged documents, including fabricated magnetic resonance imaging (MRI) results, to persuade victims to download the malware.
The UK’s National Cyber Security Centre, working with the US Federal Bureau of Investigation (FBI) and Dutch intelligence services, said it was “almost certain” that Iran uses cyber operations to help suppress people it considers a threat.
The FBI warning said it was an update to an alert issued in March 2026 describing efforts by Iran’s Ministry of Intelligence and Security to use malware to collect data on targets.
