A joint cybersecurity warning issued this week has thrown a spotlight on Iran’s expanding digital surveillance apparatus. The United States, the United Kingdom and the Netherlands jointly flagged a spyware toolkit, dubbed Chosen Break, which they say has been deployed by Iranian state-linked actors against journalists, human rights activists and government critics worldwide.
Britain’s National Cyber Security Centre described the operation as a sustained phishing campaign carried out primarily through widely used messaging platforms, including WhatsApp and Telegram. Once a target’s device is compromised, the malware is capable of harvesting emails, private messages and other sensitive material.
« These electronic campaign details reveal Iran’s relentless use of digital surveillance to suppress regime critics and steal communications while breaching devices, » said Paul Chichester, the NCSC’s director of operations, in a statement accompanying the alert.
What makes Chosen Break particularly alarming, according to the advisory, is the breadth of its capabilities. Beyond intercepting messages, the tool can extract contact lists, hijack social media accounts, capture whatever appears on a victim’s screen, and even switch on a device’s microphone remotely. Investigators also flagged a disturbing pattern: personal data lifted from some victims later surfaced on leak websites believed to be linked to Iranian-affiliated networks.
The FBI issued its own companion alert, attributing the tool to Iran’s Ministry of Intelligence and Security and stating that Tehran uses it « to gather intelligence, leak data, and harm the reputation of targets. » The near-simultaneous warnings from three separate national agencies underscore a hardening transatlantic response to cyber threats traced back to Iran, at a moment when relations between Tehran and Western capitals remain strained over the nuclear file and wider regional rivalries.
Cybersecurity analysts note that campaigns of this kind rarely target ordinary citizens; instead, they concentrate on individuals whose work already makes them vulnerable — reporters covering Iran, exiled dissidents, and rights defenders documenting abuses. That pattern, officials say, points to a broader strategy of transnational digital repression rather than conventional espionage. The three governments behind Tuesday’s alert urged at-risk users to adopt stronger account protections, including two-factor authentication, and to treat unsolicited links or attachments on encrypted messaging apps with heightened suspicion.
