Iran Hacks: Fake Apps Steal Data Via Spyware

State-sponsored Iranian hackers are allegedly employing deceptive applications, masquerading as legitimate cybersecurity tools such as Norton Antivirus and password manager KeePass, to secretly install Windows-based spyware. This threat was highlighted recently when the FBI and the UK jointly alerted the public to the sophisticated phishing tactics.

The cyber actors reportedly initiate contact through social messaging platforms, posing as IT support or known contacts to build trust. They then persuade targets to download seemingly authentic files, which can include fake versions of AI video creation apps like Pictory and RunwayML, or even mock MRI test results.

The deployed spyware, identified as 'Chosen Brick,' exclusively targets the Windows operating system and possesses capabilities to capture screen content, record audio via microphones, and exfiltrate browser data. In some instances, screen captures have been used to further harass victims by publishing their personal information.

This operation is understood to be a concerted effort to suppress individuals critical of the Iranian regime. The disclosure by the FBI and the UK's National Cyber Security Centre aims to equip users with detection methods and emphasizes the importance of maintaining updated antivirus software and avoiding unofficial downloads.