TA4922 Malware Distribution via LINE Messaging App Child Process Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where the LINE messaging application (LINE.exe) initiates child processes commonly associated with malware delivery, such as command-line shells, script interpreters, and archive utilities. This pattern is often indicative of TA4922 activity, which leverages themed lures (HR, payroll, tax) delivered via the platform to execute malicious payloads.