Iranian Dissident Spyware Threat
Western nations warn that Iranian spyware and doxxing campaigns are targeting dissidents abroad.
Anonymous
Key Points
1
The CHOSEN BRICK malware can collect contact lists, email and social-media data, and remotely access a device’s microphone. The campaigns have reportedly used spear-phishing messages sent through WhatsApp and Telegram.
2
Elaj operators claim to have identified and monitored 1,600 people, with 600 allegedly reported by members of the public, although IranWire said it could not independently verify those figures.
3
Profiles published by Elaj have included highly sensitive information such as photographs, national identification numbers, birth dates and fathers’ names; it remains unclear how the project obtained data that would not normally be available through public social-media accounts.
4
Elaj’s organizers use explicitly punitive language, describing listed people as “traitors” and referring to their “identification and punishment,” while the project’s legal basis and the identity of the entity operating it remain unknown despite promotion by IRIB.
5
The candle campaign centers on Behbud Hassanzadeh, a 36-year-old law graduate who was reportedly shot at close range on January 8 while helping an injured person during protests in Fars Province and died three days later after security forces allegedly delayed his transfer to a hospital.
Iran's government is waging a coordinated campaign against dissidents and exiles using spyware, public data harvesting, and intimidation tactics that extend far beyond its borders. Financial Times, The Independent, and western intelligence agencies warned that Iranian state-linked actors deployed CHOSEN BRICK malware to steal communications, contacts, and photos from activists, journalists, and opposition figures worldwide. Simultaneously, a project called Elaj published sensitive personal data about Iranians living abroad and encouraged citizens to report additional targets — effectively crowdsourcing a surveillance and punishment network.
The dual-pronged assault reflects Iran's evolution from domestic repression to transnational targeting. While Iranians inside the country mourn their dead through quiet resistance — candle vigils and memorial music — those who fled face identification, exposure, and the implicit threat of state retribution.
CHOSEN BRICK Malware Harvests Activists' Digital Lives
The spyware poses as medical scan results — specifically MRI images — to lure victims into clicking infected links sent via WhatsApp and Telegram. The Independent reported that the malware can extract contact lists, email accounts, social-media passwords, photographs, and remotely activate a device's microphone to record conversations. UK's National Cyber Security Centre, part of GCHQ, confirmed that Iranian state actors impersonated hospital contacts to make phishing messages appear legitimate.
The campaigns targeted dissidents, activists, and journalists across multiple countries. Victims range from political opponents in exile to human-rights monitors documenting protest deaths. Once infected, a device becomes a complete window into a person's private life — their networks, communications, and voice.
Elaj Platform Names and Monitors 1,600 Dissidents Abroad
A separate Iran-linked operation called Elaj published detailed profiles of 1,600 Iranians living outside the country, claiming that 600 were reported by public members. The project posted photographs, national ID numbers, birth dates, and fathers' names — data that would be difficult to obtain from public social-media accounts alone. IranWire could not independently verify Elaj's numbers or explain how operators accessed such sensitive information.
Elaj's language is explicitly punitive. Operators describe listed people as "traitors" and reference "identification and punishment." The project is promoted by IRIB, Iran's state broadcaster, yet its legal basis and operating entity remain unknown. The platform effectively transforms ordinary citizens into informants and turns exile communities into targets for potential state action.
Candle Vigils Honor Protest Deaths and Defy Repression
As surveillance tightens, Iranians have turned to quiet, symbolic resistance. Memorial campaigns and candle-lighting ceremonies have become acts of defiance — ways to honor the dead without triggering state crackdowns. Women have organized musical performances as tributes to those killed during protests.
The focus of one campaign is Behbud Hassanzadeh, a 36-year-old law graduate shot at close range on January 8 while helping an injured protester in Fars Province. He died three days later after security forces allegedly delayed his hospital transfer. His death exemplifies the state violence that surveillance and Elaj-style targeting are designed to suppress and punish.
Sentiment
Mostly NegativeNEGATIVENEUTRALPOSITIVE
Publishers
29
Articles
25
Reach
54
A
AnonymousAuthor
