Britain’s National Cyber Security Centre, the United States Federal Bureau of Investigation and the Netherlands’ General Intelligence and Security Service issued a joint advisory this week describing a spyware family called Chosen Brick, which they say Iranian state-linked actors have used since at least 2025 to steal emails, messages and contact data from dissidents, activists and journalists, according to Infosecurity Magazine. The advisory describes a pattern of spear-phishing carried out over WhatsApp and Telegram, in which operators impersonate trusted contacts to build rapport with a target before persuading them to open a file that installs the malware on Windows devices.
NCSC director of operations Paul Chichester said in a statement carried by The Independent that the campaign reveals how Iran uses digital surveillance to repress critics of its government, and that the three governments would continue to call out the activity while offering practical protection advice to those at risk. The Independent reported that it remains unclear how many people have been affected, though the FBI has said the malware campaign dates back to at least autumn 2025.
Why Ottawa’s absence matters
What none of the coverage of this advisory addresses is the absence of Canada from the list of co-signing governments. Canada is home to one of the largest Iranian diaspora populations outside Iran, with hundreds of thousands of Iranian Canadians concentrated in Toronto and Vancouver, many of whom left Iran after the 1979 revolution or in subsequent waves of political emigration. Canadian intelligence and law enforcement agencies have separately acknowledged in past years that Iranian state actors have attempted to monitor and intimidate dissidents on Canadian soil, yet no equivalent Canadian agency appears alongside the NCSC, the FBI and the AIVD on this advisory.
It is not publicly known whether the Communications Security Establishment or the Canadian Security Intelligence Service was invited to participate in drafting or co-signing the advisory and declined, or whether Canada was simply not approached by its allies. Neither possibility has been addressed in the reporting so far, and neither the CSE nor CSIS has issued a comparable public warning to Iranian Canadians in the days since the advisory was published. That silence leaves open a question that matters to a specific, identifiable community: whether the same standard of warning and protection extended to British, American and Dutch nationals at risk from Chosen Brick has been extended to Canadians who may be targeted by the same campaign.
How the outlets framed it
Reuters and Infosecurity Magazine both treated the advisory chiefly as a technical security bulletin, focusing on how Chosen Brick spreads through messaging apps and what mitigation steps organisations should take. The Independent instead led with Paul Chichester’s language about Iran’s use of digital surveillance to repress dissidents, foregrounding the human rights and transnational repression angle over the technical detail. None of the three outlets raised the question of which allied governments were absent from the advisory, and none examined whether Canada, despite its large Iranian dissident population, was consulted, invited or simply left out of a warning that its own residents may need.
Questions Ottawa has not answered
Shurman Media contacted no government spokesperson for this piece, since the reporting available so far establishes only that a joint advisory exists and that Canada does not appear on it. What the record does not yet show is whether Canadian officials were asked to join and refused, whether they were never asked, or whether Ottawa is preparing a separate domestic notice to Iranian Canadian communities that has not yet been published. Given the scale of Canada’s Iranian diaspora and its documented history of harassment complaints filed with Canadian police services, the absence of any public statement from Ottawa in the days following the advisory is itself notable, regardless of the eventual explanation.
