The file looked like an MRI scan. Lumbar spine, several grey slices of vertebrae, a heading reading something like 'Disk Herniation and Degeneration.' For a dissident living in exile - someone with a body that has been through things, someone waiting on results - it was a plausible thing to open.

Opening it handed Iranian intelligence the microphone.

That lure, reproduced in a joint advisory published Monday by Britain's National Cyber Security Centre, the U.S. Federal Bureau of Investigation and the Netherlands' General Intelligence and Security Service, is one of several used to deliver a spyware family the NCSC has named "CHOSEN BRICK." The three agencies say Iranian state cyber actor...