Photo via Al Jazeera

Western intelligence warns of Iranian cyber threats targeting dissidents

Read the original at Al Jazeera ↗
Cite

News Agencies. (2026, September 15). Western intelligence warns of Iranian cyber threats targeting dissidents. Al Jazeera. https://www.aljazeera.com/news/2026/9/15/western-intelligence-warns-of-iranian-cyber-threats-targeting-dissidents?traffic_source=rss

Dated when The Aporia collected the article, usually within hours of publication. Check the original for its exact date and byline.

Al Jazeera · collected 2026-09-15 · by News Agencies

Quick Summary

On Tuesday, intelligence agencies from the United States, the United Kingdom, and the Netherlands issued warnings about Iranian spyware targeting dissidents living abroad through digital surveillance campaigns. The advisories highlighted a malware family called "CHOSEN BRICK," used by Iran’s Ministry of Intelligence and Security to steal sensitive information via phishing attacks on platforms like WhatsApp and Telegram. These actions are part of ongoing efforts by Western intelligence agencies to alert the public about Iran's attempts to repress its critics through cyber operations, including recent incidents affecting Stryker medical devices and Minnesota water systems.
Written by AI on 2026-09-15, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

The United States, Britain, and Netherlands have issued warnings about Iranian spyware targeting critics of the Iranian regime who live in the West. Intelligence agencies from these countries—FBI, Britain’s National Cyber Security Centre (NCSC), and the Netherlands’ AIVD—coordinated to issue advisories on this threat. Paul Chichester, director of Britain’s NCSC, stated that Iran uses digital surveillance to repress critics by stealing emails, messages, and accessing devices through a spyware family called "CHOSEN BRICK." This malware is reportedly used for "spear-phishing" attacks on messaging platforms such as WhatsApp and Telegram. The FBI warned that the Iranian Ministry of Intelligence and Security (MOIS) uses this malware to gather intelligence and damage reputations against their targets.

Written for “Iranian Cyber Threats” on 2026-11-01, grounded in this article and the 0 other(s) covering the same event.

Story

📰 Iranian Cyber Threats
Technology · 1 article(s) covering the same event.

Compared with similar articles

This article reads unscored and hedges 9% of its claims. Each row says how that neighbour differs.
WATCH: Urgent investigation into cyberattacks targeting U.S.-bound oil tankers Different event
ABC News (US)
Hedges 0 of 1 claims Outlet record 70/100
“The articles describe different incidents: one about Iranian cyber threats against dissidents and another about cyberattacks on U.S.-bound oil tankers.”
Iran issues chilling warning to US and its allies as tensions escalate Different event
The Independent
⚖️ Leans left Hedges 1 of 17 claims Outlet record 59/100
“The articles describe different events: one about cyber threats against dissidents and another about Iran's warning regarding a potential offensive move by the U.S. and its allies.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
11
sentences that state something as happening or true
Uncertain
9%
1 of 11 hedged ("reportedly", "may", "according to")
Leaning
withheld
no quote in the article backed the model's score
Publisher signals
60/100
Al Jazeera's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
1
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-09-15 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

Al Jazeera · 4571 article(s) · 2 correction(s) detected
Running correction rate · 2 correction(s)
2026-10-03
Tennessee prisons official resigns after Christa Pike’s failed US execution
2026-09-30
Indonesia suspends five officials over luxury apartments for inmates

Who wrote this

News Agencies
2 article(s) here · 0 carrying a prediction
🔮 Plumes of smoke could be seen rising from the vicinity of the palace.
2026-10-15 · assertive framing · Houthis target Yemen’s presidential palace in Aden with missiles
Wire or desk byline, not an individual reporter.
Also by News Agencies
Houthis target Yemen’s presidential palace in Aden with missiles
2026-10-15 · Al Jazeera
Nothing else under this byline is closely related to this article, so these are simply their most recent.

Topics

Britain FBI Iran Iranian Netherlands

Subjects

Iran GPE · 5× FBI ORG · 4× Iranian NORP · 3× Britain GPE · 2× MOIS ORG · 2× NCSC ORG · 2× Netherlands GPE · 2× National Cyber Security Centre ORG · 1× The United States GPE · 1× the United Kingdom GPE · 1×

Narrative

“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” said Paul Chichester, the director of Britain’s NCSC.
framing: assertive · carried by 1 article(s) · first seen 2026-09-15
2026-09-15 · Al Jazeera
Western intelligence warns of Iranian cyber threats targeting dissidents · assertive framing

Claims (11 extracted, 1 hedged)

The United States, the United Kingdom and the Netherlands have warned that Iranian spyware is being used to hunt dissidents living in the West. asserted
spyware → warn → West
Iran is “almost certainly” using cyber operations to target Iranian critics of the regime, intelligence agencies from the trio of countries cautioned on Tuesday. asserted
agencies → use → Tuesday
In coordinated advisories, the FBI in the US, Britain’s National Cyber Security Centre (NCSC) and the Netherlands’ AIVD intelligence service all repeated the same warning. asserted
FBI → coordinate → warning
“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” said Paul Chichester, the director of Britain’s NCSC. asserted
Chichester → reveal → NCSC
Chichester highlighted a spyware family known as “CHOSEN BRICK” that is allegedly used by Iranian state-linked cyber actors to steal sensitive information through “spear-phishing” campaigns on messaging platforms including WhatsApp and Telegram. uncertain
that → highlight → WhatsApp
The FBI said that Iran’s Ministry of Intelligence and Security (MOIS) was using the malware to “collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets”. asserted
Ministry → say → targets
The advice is a continuation of regular warnings issued by Western intelligence over Iran’s efforts to target dissidents abroad. asserted
advice → issue → dissidents
In a warning issued in March, the FBI had described alleged MOIS efforts to use the malware to collect data on targets that was then posted online by a persona known as “Handala Hack.” asserted
that → issue → Hack
That attack in March crippled the global networks of Stryker, one of the world’s largest medical device companies, with an Iran-linked hacking group claiming responsibility and warning it marked “the beginning of a new chapter in cyber warfare”. asserted
it → cripple → warfare
The so-called Handala hackers also claimed to have gained access to the personal emails of Kash Patel, the director of the US Federal Bureau of Investigation (FBI), sharing photographs and documents from the official online. asserted
hackers → call → official
In July, US officials said a cyberattack on water systems in the state of Minnesota resembled the “Handala Hack”. asserted
cyberattack → say → Hack
💬Give feedback
🕘History 🎫Support
Terms · Privacy · beta v2.0.0
Articles to 1 Nov 2026