HighEarly warningMalwareUnited states · English
US, UK, Netherlands warn of Iranian CHOSEN BRICK spyware targeting press
First seen 15 Sept, 21:57 WIBLatest 18 Sept6 articles · 6 publishers
actor: handalaVerify evidence
Confidence index · preliminarycomputed by the pipeline (V0.7)high
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
- Turn on two-step verification for email, banking, and social media.
- Install apps only from official stores and never open APK files sent over chat.
- Keep the operating system and apps updated and leave built-in protection on.
Literacy audienceTelegram users in IndonesiaWhatsApp users in IndonesiaSocial media and messaging users
Literacy topics
- Preventing takeover of social media and messaging accounts
- Turning on two-step verification
- The danger of APK files and unofficial apps
Extracted claims
Victimnot found
not identifiedActorconfidence 0.60
HandalaAttack typeconfidence 0.90
Malware4 differing values across articles; review needed.Event datenot found
not identifiedLocationUnited states
Target groupIndividuals
Status
- D1 Machinehigh trust
Conclusion
- D1 MachineHappened
Source chronology
6 articles, by publication time15 September 20261 articles
- 21:57 WIBFirst reportfull text hashedUS, UK, Netherlands warn of Iranian CHOSEN BRICK spyware targeting press
jpost.com
16 September 20263 articles
- 03:19 WIB+5 hfull text hashedUK, US, Netherlands warn of Iranian spyware targeting dissidents
aljazeera.comHandala
- 05:32 WIB+8 hfull text hashedWestern agencies warn on Iranian spyware targeting dissidents
ozarab.mediaHandala
- 15:58 WIB+18 hfull text hashedUK, US and Netherlands expose Iran linked spyware campaign targeting dissidents
dig.watchHandala
Show all 6 articlesCollapse
17 September 20261 articles
- 13:22 WIB+39 hfull text hashedIranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware
cybersecuritynews.com
18 September 20261 articles
- 18:30 WIB+69 hfull text hashedWhat is Chosen Brick? UK, US, Netherlands warn of spyware campaign targeting Iran critics worldwide
indiablooms.com
Relations between articles
15 pairs likely independent
Evidence
Hashes prepared6full text hashed 6
first evidence_uida83c9bf14f71e8c47c02f9a5
6 of 6 evidence records are in Merkle batchesFlow comparison D1–D4
each flow's preventive output; this is where they differ · D1 changed 4 times · since 29 Sept| D1Machine12 Oct | D2Public surveynone yetHelp review | D3Institutionnone yet | D4Official recordnone yet | |
|---|---|---|---|---|
| Literacy audience | Telegram users in IndonesiaWhatsApp users in IndonesiaSocial media and messaging users | – | – | – |
| Literacy topics |
| – | – | – |
| Preventive steps |
| – | – | – |
| Institution's reason | – | – | – | – |
Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents