:quality(90):no_upscale()){kind=logo}
Three Governments Independently Warn that Consumer Messaging Apps Are Under Attack
STATUS: Coordinated Multi-Government Advisory SEVERITY: 6/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Oct 12, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
In coordinated advisories published the same week, the FBI, the UK's National Cyber Security Centre, and the Netherlands' AIVD intelligence service each warned that state-sponsored actors are now using consumer messaging platforms as a primary vector for compromise, not as one method among many. The advisories from three allied agencies trace initial access to consumer messaging apps, where any party holding a number or a username can open a conversation and spend weeks earning trust before a file ever appears.
What Happened
The UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands’ General Intelligence & Security Service (AIVD) published a join advisory on September 15, 2026 covering CHOSEN BRICK, a Windows Spyware family used against dissidents, activists, and journalists in the three countries (and abroad) since at least 2025. The advisory cites no CVE. Nothing in the chain is exploited. Initial access is the focus of the conversation. Each advisory detailed the same pattern of trusted-contact impersonation, malware delivered directly through popular chat apps, and ongoing surveillance conducted through the same channels victims use to communicate.
Attackers research the target, then open that conversation on WhatsApp, Telegram, or social media while posing as a known contact or as technical support, building rapport over days or weeks before any file appears. The payload is a Windows executable dressed as something ordinary: Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, and in some cases MRI scan results. Running it shows a plausible screen matching the lure while the core component installs behind it.
No messaging app was defeated in this chain. The aspect the attackers exploited is reachability. A consumer platform is built so that anyone holding a number or a username can start a conversation and the target's only test of who sits on the other end is judgment. The advisory records that judgment failing after weeks of patient contact. The design of the attacks is deliberate. Traffic to widely used, encrypted consumer messaging services blends into normal network activity, sidestepping security teams and avoiding detection that would otherwise happen when unfamiliar infrastructure is used.
Delivery follows the same logic. Initial delivery often aims at the work or corporate device and when that fails, or when the risk of detection there is judged significant, the actor asks the target to open the file on a personal device instead. Device controls are never tested fully by the attacker. Instead, they move the target to a device where they do not apply.
On the host, CHOSEN BRICK persists through a Run key under HKCU and adds a Microsoft Defender exclusion. Command & Control runs over Telegram with a distinct bot ID per victim device so that one discovery doesn’t expose the others. Exfiltration goes to Telegram and to commodity cloud storage. Capabilities include screen capture, microphone capture, theft of email, and Telegram/WhatsApp data. The agencies observed no automated lateral movement; the malware focuses on single devices. No agency published a victim count. Personal details of some earlier victims have appeared on leak sites which puts physical safety in scope alongside the data loss.
What They Found and What It Means
Finding | What It Means | Operational Consequence | Open Question |
Three national security agencies, from three different countries, independently confirmed the same pattern of state-sponsored actors using consumer messaging apps as a primary attack vector. | Three separate intelligence services, each working from their own national threat picture, arrived at the same conclusion independently, rather than one country flagging an isolated regional problem. | A pattern confirmed by three independent national agencies carries a different weight than a single vendor's threat report and warrants a corresponding level of institutional attention. | How many other national security services are seeing the same pattern but haven't yet published a coordinated advisory about it. |
The attack chain starts with impersonating a trusted contact inside a messaging app and building rapport before delivering malware disguised as an ordinary file. | This bypasses the instinct most security training is built around, suspicion of unknown senders, because the contact appears to be someone the target already knows. | Awareness training focused on recognizing unfamiliar senders or obviously suspicious messages does not address an attack that specifically impersonates someone already trusted. | Whether an organization's security awareness training addresses impersonation of known contacts specifically, rather than only unknown or suspicious ones. |
One identified malware strain uses a mainstream messaging app's own infrastructure as its command-and-control channel, routing stolen data through the same platform the victim uses for ordinary conversation. | Malicious traffic designed this way is built specifically to blend into normal network activity rather than stand out to detection tools watching for unusual destinations. | Network monitoring built around flagging traffic to unfamiliar or suspicious infrastructure may have nothing to flag, since the traffic's destination is a legitimate, widely used service. | Whether current network monitoring can distinguish malicious use of a legitimate messaging platform's infrastructure from the platform's own ordinary traffic. |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Sensitive coordination can run in a consumer messaging app as long as the app is encrypted. | Encryption held throughout this campaign. What the attackers needed was the ability to open a conversation with the target, which a consumer platform grants to anyone holding a number or username. | BlackBerry® SecuSUITE® limits contact to identities the organization has provisioned. There is no route for an unenrolled party to open a conversation with a BlackBerry SecuSUITE user. BlackBerry gives organizations a channel built specifically for the kind of informal, fast coordination that currently defaults to consumer messaging apps. |
Training staff to be wary of unknown senders covers messaging-app risk. | The approach arrives from an account presenting as a known contact or as technical support, after days or weeks of rapport, and the file shows a working decoy screen. Suspicion of strangers does not apply. | BlackBerry SecuSUITE covers phone, tablet, laptop and workstation, including BlackBerry SecuSUITE for Windows Desktop, so no device class leaves staff falling back on a consumer app. |
Device management defines the organization’s exposure to targeted social engineering. | When the corporate device looks likely to block or flat the file, the actor asks the target to open it on a personal device, outside the managed estate. | BlackBerry® UEM enforces which applications are permitted on managed devices, and Dynamics containerization keeps work data and work accounts out of the consumer plane. |
Recommended Actions
IMMEDIATE | Hunt the host artifacts the advisory names: Run key persistence under HKCU, Defender exclusions added outside change control, and outbound Telegram bot API traffic from hosts with no business reason for it. |
IMMEDIATE | Brief staff on the request to refuse when a known contact, or someone presenting as support, claims to be unable to get a file to open on the work machine or suggest trying it on a personal device. |
SHORT-TERM | Name the channel of record for sensitive coordination and provision it on every device class staff work from (laptops and workstations included). Be aware that removing consumer apps without a replacement channel will likely move traffic to personal devices. |
SHORT-TERM | Identify staff whose exposure profile matches the advisory’s victim set, including those who correspond with journalists, NGO partners, and widely ranging contacts. Brief them individually rather than through a general awareness email. |
ONGOING | Consumer messaging applications must be treated as an initial-access surface in threat modeling in the same fashion that email attachments and removable media like USB are handled. |
BlackBerry Secure Communications Position
Encryption is not the failure point. The malware excludes itself from the host’s antivirus and runs command and control through a service the network already carries. Organizations that still treat that app as separate from their real security posture are drawing a line that state-sponsored actors have already stopped respecting. Procurement should be focused not on which product blocks which files or attacks. Permission to connect, converse, and contact your people in the first place is the solution to these attacks.
Citations:
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists (UK National Cyber Security Center, September 15, 2026).
Iranian Cyber Targeting of Dissidents, Activists and Journalists (Advisory UK National Cyber Security Center, September 15, 2026).
:quality(90):no_upscale())