Suspicious file execution spawned from WhatsApp or Telegram client

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects instances where a desktop messaging application (WhatsApp or Telegram) spawns a child process that matches known suspicious naming conventions or lure keywords, suggesting that a user has executed a malicious file shared via the platform.