On September 15, 2026, the UK's NCSC, the FBI, and the Netherlands' AIVD jointly published an advisory naming CHOSEN BRICK, a Windows surveillance implant attributed to Iran's Ministry of Intelligence and Security. The FBI tracks the same malware family under the name HEAVYGRAM; the agencies do not formally declare the two names exact aliases, and analysts should use both in reporting. The campaign has targeted dissidents, activists, and journalists in the UK, US, and Netherlands since at least 2025, with the underlying operation dating to autumn 2023 according to the FBI. The attack chain begins with extensive reconnaissance: operators study the target's network and contacts before approaching on WhatsApp or Telegram, impersonating someone the target already knows or a credible organization. They spend days building rapport before sending the payload. Documented lures include files impersonating Norton Antivirus, Adobe Flash Player, KeePass, Telegram, Pictory, RunwayML, and in one case a fake MRI scan showing a disc herniation tailored to a target known to have a back injury. Once a target opens the file, a decoy screen appears while CHOSEN BRICK installs silently. The malware persists via a HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry entry and immediately begins harvesting contacts, email inboxes, social media messages, and browser authentication tokens. It captures screenshots, activates the microphone for audio recording, and routes exfiltration through cloud object storage services including Vultr, Backblaze, and Storj. Each victim is assigned a unique Telegram bot for command-and-control. CHOSEN BRICK also adds exclusions to Microsoft Defender to evade detection. A data-wiping module is documented in the advisory. The NCSC advisory includes an unusually explicit statement: "Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime. In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally who they perceive as enemies of the regime."

Google published its September 2026 Pixel security bulletin on September 15, addressing 110 vulnerabilities across the Pixel device line. CVE-2026-58704 is a privilege escalation vulnerability that Google notes is under exploitation in targeted attacks. Google's use of "limited, targeted exploitation" in its Pixel advisories has historically indicated commercial spyware or nation-state tooling rather than broad criminal campaigns; the same language accompanied the Pixel zero-days associated with Pegasus and Predator spyware use in prior years. The September bulletin covers two security patch levels: the 2026-09-01 level addresses a core set of vulnerabilities, and the 2026-09-05 level includes all of the 2026-09-01 fixes plus device-specific and kernel component patches. Pixel devices receive security updates directly from Google and should apply the September update as soon as it is available in Settings.

An attacker compromised the website of the developer behind Admin Menu Editor Pro, a premium WordPress plugin sold directly to customers outside the WordPress.org repository. The attacker modified the update packages distributed through the plugin's own update mechanism and pushed the trojanized version to customers who had the plugin installed and auto-updates enabled. More than 200 paying customers received the malicious update. The payload created a hidden WordPress administrator account with attacker-controlled credentials that does not appear in the standard WordPress admin user list. The free version of Admin Menu Editor, distributed through the WordPress.org plugin repository, was not affected because the WordPress.org repository has its own distribution infrastructure separate from the plugin author's direct sales site. The plugin author discovered the compromise and has notified affected customers.