Fake Apps, Real Spies: How Iran Tracks Dissidents Through Telegram

Multiple national cybersecurity agencies (FBI, NCSC, AIVD) warn that Iranian government-linked actors are deploying HEAVYGRAM/CHOSEN BRICK malware to target dissidents, journalists, and opposition figures via social engineering (Telegram, WhatsApp, Instagram). The Windows-only malware achieves persistence, evades Defender, uses Telegram bots and cloud storage for C2 and exfiltration, can capture screens, audio, messaging data, and wipe systems; victim data has been posted to pro-Iranian leak sites. Agencies recommend phishing-resistant MFA, application allowlisting, endpoint/network monitoring, and reviewing both corporate and personal devices for compromise.