Iranian state hackers use fake MRI scans to target dissidents, western intelligence warns

Western intelligence agencies have warned of a highly targeted Iranian cyber-espionage campaign that uses malware disguised as medical records, including MRI scans, to infect the devices of dissidents and regime critics.

According to western officials, state-backed hackers are masquerading as medical professionals or trusted intermediaries to deliver the malicious files. Once opened, the file deploys spyware that gives Tehran’s security services backdoor access to the target’s personal data, private communications, and real-time location.

Using personal health data as bait is a particularly insidious tactic, security experts say, because it preys on personal anxieties, making targets far more likely to open the attachments without checking their origin. The warning comes amid a broader pattern of state-directed cyber operations designed to track, harass, and silence opponents of the Iranian government living in Europe and North America.

This digital offensive is unfolding alongside a sharp escalation in Iran’s physical military operations in the Middle East, which are increasingly straining Western defensive resources. The sheer scale of Tehran’s physical pressure was illustrated last week during a major ballistic missile strike on a US military facility in Jordan.

During the attack on the Muwaffaq Salti Air Base near Azraq, American forces were forced to expend an unprecedented volume of their local air-defence stockpile. US and regional officials familiar with the incident said that American forces fired between 60 and 70 high-end Patriot interceptors, along with more than a dozen THAAD interceptors, to counter a volley of approximately 20 Iranian ballistic missiles. One US official noted that the number of interceptors used in this single attack was roughly equivalent to what forces would normally expend over an entire week of conflict.

Jordan's armed forces reported that their own air defences engaged the incoming missiles, destroying 18 of them, while two landed in unpopulated areas.

Despite the heavy defensive response, some of the missiles broke through. US officials confirmed that the strike damaged several American aircraft at the base. An A-10 Thunderbolt II ground-attack jet lost a wing, while eight F-15 fighter jets suffered lighter damage but have since been returned to service. No US personnel were killed in the bombardment, though an earlier Iranian strike on the same base in July killed three American service members.

Military analysts say Iran is systematically adapting its conventional tactics to complicate western tracking systems. In the recent Jordan attack, the Iranian missiles used warheads that split into multiple projectiles near their targets, multiplying the number of objects defensive systems had to track. Tehran is also varying flight paths, speeds, and trajectories based on data gathered from previous strikes.

With Iran pressing its adversaries in both the physical and digital arenas, western security agencies are urging high-profile critics, journalists, and activists to treat any unsolicited medical communications with extreme suspicion.