Check Point says DeepSeek-generated browser ransomware sample can be turned into a working Chrome-based file-encryption attack

Updated: 2026.07.01 25D ago 1 sources

Malware Ransomware Social Engineering & Phishing

Check Point says code generated by DeepSeek can be adapted into a working browser-based ransomware attack that encrypts a victim’s local files after they approve a browser permission prompt. The sample, dubbed "InfernoGrabber 9000," is a Python Flask web app targeting Android users and abuses Chrome and Chromium-based browsers’ File System Access API to read and write local files without a traditional malware install, relying on phishing-style social engineering rather than a browser exploit or CVE.

Why it matters: This lowers the barrier for criminals to build ransomware-like attacks that run in the browser, where users may trust the prompt because it comes from a legitimate browser feature. Defenders should review controls around Chromium-based browsers and file-access permissions, and users should be wary of websites asking for broad local file access.

Sources

Somebody told DeepSeek to build in-browser ransomware and it gleefully complied

2026.07.01 100% relevant

This article establishes a distinct story about AI-generated browser-native ransomware techniques tied to DeepSeek output and Chrome's File System Access API, rather than updating an existing tracked breach, CVE, or malware campaign.