Iran loosens “foreign messenger” rules as Western warnings flag spyware aimed at dissidents—what’s the next cyber move?

Iran has reportedly lifted a ban on the use of foreign messengers by government agencies, a policy shift framed by the Islamic Republic as a tool to respond faster to “doubts” and “planted information” while countering psychological operations and information warfare. The announcement was attributed to government spokeswoman Fatemeh Mohajerani, who said the change is intended to improve the state’s ability to address emerging narratives and hostile influence campaigns. In parallel, Western intelligence reporting highlighted Iranian cyber threats aimed at dissidents abroad, pointing to spyware associated with the label “CHOSEN BRICK.” The juxtaposition suggests Tehran is recalibrating both its internal communications posture and its external influence and surveillance capabilities. Strategically, the move sits at the intersection of information control and operational flexibility. Allowing foreign messengers can reduce friction for rapid coordination, but it also creates new attack surfaces and complicates monitoring, which implies Iran is betting on either improved tradecraft, selective adoption, or tighter endpoint controls. For Western partners and diaspora communities, the warning about spyware targeting critics indicates that the cyber dimension of Iran’s influence operations remains active and potentially adaptive to countermeasures. The likely beneficiaries are Iranian government and security-linked actors seeking faster narrative response and more effective targeting of opposition networks, while dissidents and civil society abroad face heightened surveillance risk. Market and economic implications are indirect but real through risk premia in cyber insurance, compliance tooling, and the broader security services ecosystem. If the “CHOSEN BRICK” threat is credible and widely exploited, it can raise costs for identity verification, endpoint security, and incident response for organizations with Iranian-linked exposure, including NGOs, media, and fintech firms that serve diaspora communities. The policy shift toward foreign messengers may also influence demand for secure communications products and managed security services in the region, though the articles do not cite specific financial instruments or quantified losses. In currency terms, no direct FX linkage is provided in the reporting, but cyber escalation typically contributes to a modest increase in regional geopolitical risk pricing. What to watch next is whether Iran issues implementation guidance that clarifies which messengers are permitted, under what security controls, and whether government endpoints will be required to use specific gateways or logging standards. On the threat side, monitoring should focus on indicators of compromise tied to “CHOSEN BRICK,” including distribution methods, command-and-control infrastructure, and targeting patterns against dissidents abroad. A key trigger for escalation would be any publicized wave of arrests or platform takedowns linked to cyber-enabled surveillance, or additional Western advisories naming new malware variants. Over the next weeks, the most actionable signals are updates from threat-intelligence vendors, changes in Iranian government communications policy enforcement, and any observed increase in phishing or spyware delivery attempts targeting opposition figures.

Geopolitical Implications

• 01

  Tehran is likely recalibrating its information-control apparatus by balancing operational speed with counter-PSYOP capabilities.

• 02

  Cyber operations against dissidents abroad indicate sustained pressure on opposition networks and potential for cross-border intelligence friction.

• 03

  Western advisories may harden diaspora security posture and increase diplomatic and regulatory scrutiny of Iranian-linked cyber activity.

Key Signals

• —Official Iranian guidance specifying permitted foreign messengers and required security controls
• —Threat-intelligence updates on CHOSEN BRICK: new hashes, delivery chains, and command-and-control changes
• —Reports of increased phishing/spyware attempts against Iranian dissidents and affiliated organizations
• —Any public Iranian enforcement actions or platform disruptions tied to cyber-enabled surveillance