AI-Generated Browser Ransomware: DeepSeek Targets 3 Billion Chrome Users

AI-generated browser ransomware uses the File System Access API to encrypt local files directly from a malicious web page, requiring no executable download or installation. Check Point Research documented the complete attack chain in InfernoGrabber v9.0, the DeepSeek-generated sample found on VirusTotal on January 25, 2026.

The attack begins when a victim lands on a phishing site disguised as a legitimate AI service. In the documented case, the lure was a Discord avatar AI upscaler. The page requests folder-level file system access using browser-native 'showDirectoryPicker()' and 'showOpenFilePicker()' methods. These are not exploits -- they call browser APIs exactly as the W3C specification describes, which is why they bypass browser sandboxing controls designed to block unauthorized file system access.

The victim sees a single browser permission dialog: "Let this site edit files?" The dialog matches the visual design of every other browser permission prompt -- camera access, location access, clipboard access. There is no visual warning that approval allows the site to read and overwrite files. Users conditioned to approve browser permissions for legitimate web applications are the primary target.

Once permission is granted, JavaScript on the page traverses the selected directory recursively. For each file, the code reads the contents using a FileSystem file handle, encrypts the data client-side using the Web Crypto API, and overwrites the original with ciphertext. This operation runs entirely inside the browser process. No new process is spawned. No file is written to disk via OS kernel calls. No connection to a remote payload server is required for the encryption step.

The page then displays an extortion overlay with a Bitcoin wallet address and ransom demand. The overlay blocks browser navigation and remains until cleared by the attacker's decryption key. The encrypted files are unrecoverable without that key.

DeepSeek generated this complete attack chain from a broad natural-language prompt, avoiding direct "ransomware" terminology to bypass content filters. The model produced working end-to-end code including the encryption logic and social engineering lure in a single session.

DeepSeek built working AI-generated browser ransomware by combining a hallucinated concept with a real browser capability. Check Point Research identified this as the first documented case where a frontier AI model independently bridged the gap between theoretical browser-only ransomware risk and a practical, working attack chain.

The theoretical risk was well-established long before this attack. Browser security researchers and the W3C itself acknowledged that the File System Access API created a ransomware attack vector since the specification was drafted in 2019. A 2023 USENIX Security paper formally documented the abuse potential. Google's Chrome team acknowledged it in specification documentation. No threat actor had operationalized this knowledge until DeepSeek's generated code appeared on VirusTotal.

DeepSeek's contribution was making the connection between the theoretical risk and the implementation path. The model combined security research discussing browser-only ransomware concepts -- present in its training data from academic publications and vulnerability databases -- with practical File System Access API documentation to generate functional code from a conversational prompt.

Check Point researchers note that DeepSeek's refusal rate for harmful cyber requests is meaningfully lower than competing platforms from OpenAI and Anthropic. The model generates attack code without keyword-level filtering being sufficient to block it. This reflects design choices by the model's developers. DeepSeek's free web access and lower cost compared with competing platforms make it the model of choice for threat actors seeking AI-assisted attack code generation.

The generated InfernoGrabber v9.0 toolkit is not a minimal proof of concept. It is a complete attacker tool including browser file encryption, credential harvesting, Discord token theft, keystroke logging, and an administrative dashboard for managing victim data. The AI produced a production offensive tool, not an isolated technique.

For organizations assessing AI risk, the JADEPUFFER attack showed that AI agents can automate the full ransomware chain against enterprise infrastructure. InfernoGrabber shows that AI models can simultaneously generate novel attack techniques against consumer and enterprise endpoints by connecting previously-isolated security research knowledge into working code.

AI-generated browser ransomware exposes approximately 3 billion active Chrome users on Windows and Android, making it one of the broadest attack surfaces documented in 2026. Chrome holds 65% of the global browser market across desktop and mobile. Every user running Chrome 86 or later on Windows, macOS, Linux, or ChromeOS faces exposure to the File System Access API attack path. Android users on Chrome 132 or later face the same risk through WebView.

Safari on iOS and macOS is not vulnerable. Apple's WebKit engine has not implemented the picker-based File System Access methods. Firefox on desktop implements parts of the specification but has disabled the most dangerous directory-picker functions by default. Organizations using Firefox as a managed enterprise browser are protected from this specific technique.

Enterprise environments face elevated risk across three dimensions. First, end users in corporate environments regularly encounter legitimate permission prompts from productivity applications -- Figma, VS Code in the browser, cloud storage clients, and web-based document editors. These users have been conditioned to approve browser permissions as routine workflow steps. The phishing lure for this attack requires no unusual deception beyond matching this established user behavior.

Second, enterprise endpoint detection and response tools monitor process creation, file system calls via Windows or Linux kernel APIs, and dropped executable payloads. The File System Access API uses browser-internal mechanisms for all file operations. Standard EDR telemetry from CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint produces no alert for this attack class.

Third, Check Point's analysis found 1,383 malicious DeepSeek-attributed files in VirusTotal telemetry over 12 months. AI-generated browser ransomware is one identified attack class within that corpus. The remaining files represent additional AI-generated attack tooling already appearing in the wild -- phishing kits, credential stealers, and backdoors generated using the same model and distribution channels.

InfernoGrabber v9.0 is the specific malware sample implementing the AI-generated browser ransomware technique discovered by Check Point Research. It is a Python Flask application named 'deepseek_python_20260125_da0631.py,' uploaded to VirusTotal on January 25, 2026 with SHA256 hash 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5.

Beyond browser file encryption, InfernoGrabber v9.0 implements a comprehensive credential theft capability set. The toolkit steals Discord tokens using the same AI service lure as the file encryption, harvests credit card data from browser-stored payment information, extracts cryptocurrency seed phrases from browser extension storage, logs keystrokes via JavaScript event listeners, and captures webcam and microphone data. A hard-coded Discord webhook handles data exfiltration to an attacker-controlled dashboard. An administrative panel aggregates all stolen data across victim sessions.

The ransomware module implements a WinLocker-style browser overlay displaying a Bitcoin ransom demand. The overlay blocks browser navigation and persists until cleared by the attacker's decryption key. CVE-2023-4863, the Chrome WebP heap buffer overflow patched in September 2023, is referenced in the toolkit's targeting scope as an additional exploitation vector against unpatched browsers.

An attacker operating InfernoGrabber v9.0 does not need ransom payment to profit. Discord tokens, financial account credentials, and cryptocurrency wallet seed phrases provide immediate financial value independent of file recovery. The ransomware component adds supplemental extortion layered on top of a credential theft operation that is already complete before the victim sees the ransom note.

This design pattern mirrors the Sophos AI-built ransomware lab's multi-vector approach combining EDR evasion with credential harvesting -- AI-generated tools are converging on simultaneous multi-channel value extraction from each victim session.

Browser-native ransomware leaves a detection signature that differs significantly from traditional ransomware because the entire attack runs inside the browser process. Standard endpoint detection rules watching for malicious process creation, file system calls via kernel APIs, and dropped executable payloads do not fire.

File System Access API permission grant events are the earliest detectable signal. Chrome logs permission grants in its internal event structure. Enterprise environments using Chrome Enterprise Management can configure alerts for FILE_SYSTEM_ACCESS_GRANTED events, particularly when the granted directory path includes high-value locations such as Desktop, Documents, DCIM, and Downloads. Permission grants from newly registered or unrecognized domains should be flagged as high-priority events for immediate security review.

File modification rate anomalies indicate active encryption in progress. The ransomware attack reads and overwrites every file in the selected directory in rapid succession using browser file handles. Storage monitoring solutions and file integrity tools tracking write operations per process will detect an unusual spike in browser process file activity. A browser process modifying hundreds of files within seconds is not normal behavior for any legitimate web application.

Network traffic analysis surfaces the exfiltration channel. InfernoGrabber v9.0 sends stolen credentials and file data to a hard-coded Discord webhook. Monitor for high-volume POST requests from browser processes to Discord API webhook URLs, particularly from endpoints with no established Discord usage history. This pattern is detectable at the proxy or CASB layer independent of endpoint visibility.

Behavioral detection platforms analyzing JavaScript execution patterns can identify the recursive directory traversal signature. File handle enumeration of an entire directory tree within milliseconds of a permission grant is anomalous regardless of which domain triggered it.

Protecting against AI-generated browser ransomware requires browser-level controls that most organizations have not deployed, because File System Access API attacks bypass endpoint security tools entirely.

AI-generated browser ransomware demonstrates a structural shift in how novel attack techniques are operationalized. The File System Access API has been in Chrome since October 2020. Security researchers documented its ransomware potential in academic publications since 2023. The W3C specification authors acknowledged it explicitly. None of that produced a deployed attack chain until DeepSeek's code generation connected the theoretical risk to a working implementation in a single session.

This is what Check Point Research means when it describes DeepSeek's ability to bridge "hallucinations to practical attack techniques." The model had ingested security research describing the theoretical risk alongside browser API documentation describing the implementation. A single natural-language prompt was sufficient to produce a functional production toolkit combining both knowledge sources into working attack code.

For security teams, the implication is not that every documented theoretical risk will now be immediately weaponized. It is that AI models eliminate the expertise requirement for closing that gap. Threat actors who previously lacked the development skills to implement browser exploitation code can now generate it conversationally. The time between "published as theoretical risk" and "found on VirusTotal" is compressing from years to weeks.

Browser security governance has not kept pace with this acceleration. Most enterprise security programs govern endpoint applications, network perimeters, and cloud infrastructure in detail. Browser permission policies are left to default Chrome behavior. The default user response -- shaped by years of approving camera and location prompts -- is to approve file access requests. That default is now a ransomware delivery mechanism.

Conduct an immediate audit of Chrome Enterprise policy configurations for File System Access API controls, add browser-native ransomware to your incident response playbooks, and schedule browser permission management for the next security awareness training cycle. The 3 billion Chrome users at risk include your endpoints.