You know that “hey, quick question” message that pops up on WhatsApp or Telegram… from someone you kinda-sorta know… and it’s asking you to install a “helpful” app? Yeah. That’s the kind of awkward opener Iranian state-linked hackers have been using to land CHOSEN BRICK on Windows PCs—often dressed up as something totally normal like Telegram, Norton, KeePass, or even a fake Flash Player. The app looks legit, smiles politely, and then quietly starts acting like a private investigator who never clocks out.
The setup: how a normal chat turns into a not-normal install
The CHOSEN BRICK playbook doesn’t start with some Hollywood “you’ve been hacked” moment. It starts with a message that feels… familiar. A WhatsApp or Telegram ping from a trusted contact (or someone pretending to be one), sometimes posing as technical support, sliding into your DMs with a “quick fix” or a “can you check this?” request. That exact pattern—impersonating trusted contacts or tech support over WhatsApp/Telegram—is called out in government reporting on CHOSEN BRICK.
And here’s the part that makes it work: they’ll often nudge you to run the file on a personal device. Not because it’s “easier,” but because your work laptop might block it. The advisory coverage notes attackers explicitly encourage targets to launch these “safe apps” off their personal machines to get around corporate security controls.
The disguises are boring on purpose (that’s why they land)
CHOSEN BRICK isn’t usually delivered as something that screams “malware.” It shows up wearing the costume of apps people already download without thinking twice, including:
- Trojanized Telegram
- Norton Antivirus
- KeePass
- A fake Adobe Flash Player
- Even AI/creative tools like Pictory and RunwayML
It’s a greatest-hits list of “stuff you might install fast” because you’re trying to get on with your day.
The lures can get weirdly personal (and that’s the point)
Sometimes the hook isn’t “install this app,” it’s emotional pressure dressed as urgency. Reports mention medical-related lures being used, including an MRI scan document as bait.
If you’re a journalist, activist, or dissident, that kind of message can feel plausible in the moment—because it’s aimed at your real life, not a generic phishing template.
The “legit” interface is part of the con
Even after you run it, the trap doesn’t spring with obvious chaos. The malicious files can show a convincing interface that matches the app you thought you installed, while CHOSEN BRICK installs quietly in the background.
So from the victim’s seat, everything looks normal… right up until it isn’t.
What CHOSEN BRICK actually does on a Windows PC (the sneaky bits)
That “normal-looking” app isn’t just sitting there minding its own business. Behind the scenes, CHOSEN BRICK gets to work on two goals: stay on the PC and stay out of sight.
1) It makes itself “sticky” with Windows Registry Run keys
A lot of Windows spyware doesn’t bother with fancy magic tricks. It uses the boring stuff that works.
CHOSEN BRICK is reported to secure persistence through Windows Registry Run keys . In plain English: it adds a setting so Windows will auto-start it when you log in, the same way legit apps can set themselves to launch on startup.
If you’re wondering why that matters, it’s simple: you can reboot all you want. It’ll come back.
2) It tells Microsoft Defender to “look away”
Next move: make detection less likely.
CHOSEN BRICK has been observed adding Microsoft Defender exclusions . An exclusion is basically a “don’t scan this” rule. So even if Defender is running, parts of the malware (or where it lives) may get a free pass.
That’s what makes it sneaky. You think you’ve got baseline Windows protection on… and it’s been politely asked to ignore the problem.
3) Command-and-control through a victim-specific Telegram bot
Now for the part that’s equal parts clever and irritating: Telegram as command-and-control (C2).
Reporting says CHOSEN BRICK connects to a unique Telegram bot that matches the victim’s ID and provides command-and-control . So instead of beaconing to some sketchy server that screams “malware,” it can blend into traffic lots of people already generate.
Here’s why that’s a headache for defenders:
- Telegram traffic can look normal in many environments.
- A bot per victim makes takedowns and tracking harder.
- It creates a neat little “remote control” channel for running tasks on the infected Windows PC .
And once it’s persistent, ignored by Defender, and quietly checking in over Telegram… that’s when the real spying starts.
What it can steal (and why it’s extra nasty for journalists and dissidents)
Once CHOSEN BRICK is comfortably parked on your Windows PC, it shifts from “quiet houseguest” to “full-time snoop.” The joint reporting around the malware spells out a pretty brutal surveillance menu.
The surveillance menu (a.k.a. the stuff you really don’t want copied)
CHOSEN BRICK has been observed doing things that map perfectly to how journalists and dissidents actually work day-to-day:
- Screenshots — it can capture screenshots, which is a fancy way of saying it can periodically take pictures of whatever you’re viewing, drafting, or reading.
- Microphone recording — it can record audio through the microphone. If you’ve ever taken a sensitive call near your laptop, you get why this is scary fast.
- Email content theft — it can steal email content. That can mean sources, drafts, attachments, and the boring-but-deadly metadata (who you talked to and when).
- Telegram/WhatsApp browser data — it can steal Telegram or WhatsApp browser data, which is the kind of detail that can turn “private chat” into “someone else’s spreadsheet.”
It also collects system information and running process lists, which helps an operator understand what you do on the machine and what tools you’re using.
The “it can get worse” part: it’s not just spyware
Some spyware steals. CHOSEN BRICK can also break things on purpose.
Per the same reporting, it can:
- Download additional payloads to
C:\Windows\SysWOW64 - Delete files
- Wipe the entire host system
That last one is the nightmare scenario for targets: you’re dealing with surveillance and the risk of losing your work, your evidence, your contacts—everything—if someone decides you shouldn’t have it anymore.
Quick, practical checks: how to spot it before your data goes on a leak site
If you’re reading this and thinking “cool cool cool… so how do I tell if my Windows PC has CHOSEN BRICK?”, you don’t need a sci-fi lab. You need a few targeted checks that match how this spyware behaves.
Fast endpoint checks (Windows PC)
These are the “show me what starts when I log in” basics—because that’s where this malware likes to hang out.
- Check Registry Run entries for new/suspicious additions
Government guidance around this activity explicitly calls out inspecting Registry Run entries for suspicious items.
What counts as suspicious? A Run entry pointing to an odd path, a weirdly named executable, or something launching from a user profile when you weren’t expecting it.
- Hunt using the advisory’s Indicators of Compromise (IoCs)
The same guidance recommends searching logs using the IoCs shared in the advisory.
If you’ve got IT help or an EDR tool, this is where you hand them the IoCs and say: “Please tell me this isn’t on my machine.”
“Why is my PC talking to that?” network checks
CHOSEN BRICK is reported to exfiltrate data through Telegram and also via certain cloud and proxy services. This gives you a clean place to look: outbound connections that don’t match your normal routine.
Red-flag destinations to investigate
Per the reporting, unexpected connections to the following should be treated as suspicious in this context:
- Telegram’s API
- Backblaze B2
- VultrObjects
- StorjShare
- IPRoyal
- LightningProxies
One extra wrinkle: proxy “smoke screen”
Newer CHOSEN BRICK variants may route traffic through SOCKS5 proxies to make the trail harder to follow.
So if you spot sudden proxy-style traffic from a device that’s never used proxies before, that’s not “quirky.” That’s a clue.
Quick triage mindset (so you don’t waste time)
If you find (a) a weird startup entry and (b) strange outbound traffic to Telegram API or those listed services, treat it as a real incident and escalate. The advisory notes stolen data can end up on pro-Iranian leak sites, so speed matters.
.png)
