Malicious Deep Link: Messaging App Spawning Command Interpreters

Detects exploitation of URI scheme handlers in Electron-based messaging apps (WhatsApp, Telegram, Discord, Signal) that spawn OS command interpreters — behavioral pattern consistent with CVE-2025-55177 and malicious deep-link attacks.