How to Detect and Block CHOSEN BRICK Spyware on Home and Small Business PCs

How can I tell if my computer has been infected with Iranian spyware? In short, look for odd behaviour, check for unauthorised processes and run a trusted scanner. Below we walk you through what we see on the bench and how you can protect yourself. What the call sounded like: a real‑world scenario We get a panicked call at 09:15 from a local news outlet. Their journalist says the laptop they use for field notes has suddenly started sending encrypted files to an unknown server, the fan is roaring at 100% and the battery drains within an hour. They suspect a state‑backed hack after a source mentioned “Iranian activists”. We pull the machine onto the bench, open Task Manager and see a process called svchost.exe running from C:\Users\Public\AppData\Local\Temp . That’s a classic sign of the CHOSEN BRICK payload that was disclosed in recent UK‑led advisories. What is CHOSEN BRICK and why should you care? CHOSEN BRICK is a stealthy spyware suite designed by Iranian state actors. It targets dissidents, journalists and NGOs by exfiltrating documents, keystrokes and webcam footage. The malware can hide in legitimate‑looking Windows services, modify the registry and set up persistent scheduled tasks. For a home user or a small business, the impact can be loss of confidential client data, reputational damage and costly downtime. How can you spot the infection on your own machine? Unusual CPU or disk usage. Open Task Manager (Ctrl+Shift+Esc) and look for any process using >20% CPU or cons