Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is controlled via the Telegram messaging app and can copy a target's emails and chat messages, take screenshots, and activate the microphone to record

Report facts: US, UK, and Dutch cybersecurity agencies describe Windows malware used by Iran’s intelligence services to spy on dissidents and journalists, controlled via the Telegram messaging app and capable of copying emails and chats, taking screenshots, and activating the microphone to record. The article focuses on targeted surveillance and remote-command malware, not specifically on AI models or agents. RealGround analysis: While the malware itself is not described as AI-driven, such state-backed surveillance tooling can be integrated with AI systems for automated analysis of intercepted data, increasing the impact of malicious AI use. Organizations with high‑risk user bases (journalists, activists, NGOs) should implement continuous red teaming and CISO‑level advisory around endpoint monitoring, secure communications, and detection of command‑and‑control patterns that could later be augmented by AI analytics.