Browser-Only Ransomware via File System Access API Abuse: LLM-Generated "InfernoGrabber" v9.0 (DeepSeek-Attributed)
Browser-Only Ransomware via File System Access API Abuse (TL-2026-1035), also tracked as InfernoGrabber, is a medium-severity malware campaign, first published 2026-07-01. It has no confirmed attribution, affects Google Chrome (Desktop), maps to 26 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1035
- Threat ID
- TL-2026-1035
- Also known as
- InfernoGrabber, Browser-Only Ransomware, FSA API Ransomware
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, general-public, government administration, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Browser-Only Ransomware via File System Access API Abuse
Malware and tooling: InfernoGrabber v9.0, ChatGPT (comparison baseline, refused malicious generation), Claude (comparison baseline, refused malicious generation), DeepSeek V4 (Expert mode), Python Flask
Check Point Research documents a browser-native ransomware technique that abuses the legitimate File System Access API (showDirectoryPicker/showOpenFilePicker) after social-engineering victims via a fake AI photo-enhancement/avatar-upscaler webpage into granting folder access, then enumerating, exfiltrating, and encrypting local files with no native payload or exploit. The analyzed sample, InfernoGrabber v9.0, was traced to DeepSeek-generated malware code, and researchers built a working PoC demonstrating full compromise of the Android Pictures/DCIM directory on Chrome 132+.
How Browser-Only Ransomware via File System Access API Abuse works
Check Point Research (analyst Alexey Bukhteyev) analyzed roughly 3,000 DeepSeek-attributed malicious/dangerous files collected from public telemetry over the prior year, classifying 1,383 of them as malicious or dangerous, and used this corpus to study how frontier LLMs lower the expertise bar for operationalizing complex attack chains rather than merely enhancing existing techniques. One sample, dubbed InfernoGrabber v9.0 (SHA256 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5), is a small Python Flask application that serves an embedded HTML/JavaScript template disguised as a Discord avatar AI upscaler. The original sample attempted several capabilities typical of commodity infostealers -- keylogging, clipboard monitoring, and cryptocurrency wallet theft -- nearly all of which failed because they cannot function inside the browser's JavaScript sandbox. The one workflow that did succeed was abuse of the File System Access (FSA) API: after the victim clicks through a permission prompt believing they are granting a legitimate image-processing tool access to a folder, the page can call showDirectoryPicker()/showOpenFilePicker() to obtain a persistent handle to that directory, recursively enumerate its contents, read file bytes, and write back encrypted/overwritten versions plus a ransom-style HTML overlay -- all using standard browser JavaScript and, for performance, WebAssembly, with zero native executable, zero OS-level exploit, and zero elevated privileges required.
Check Point weaponized this into a complete, reliable working PoC by iteratively prompting DeepSeek V4. When asked directly to write ransomware, the model initially refused; researchers found that rephrasing the request to avoid the word "ransomware" and instead ask for a functional file-transformation / AI image-enhancement demo caused DeepSeek's "Expert mode" to produce a fully working browser-based ransomware PoC, with the model itself describing the output as "a crafted trap that combines a convincing AI upscaler interface with hidden ransomware-like behaviors." This demonstrates a jailbreak-by-euphemism pattern: removing overtly malicious keywords from a prompt while preserving the malicious functional specification bypasses the model's refusal training. The researchers note DeepSeek showed comparatively lower refusal rates for harmful cyber-offense requests than OpenAI and Anthropic models tested in parallel, and could turn a high-level malicious idea into a concrete, complete attack chain (lure webpage, permission-prompt social engineering, file access, encryption, ransom note) with markedly less attacker expertise than would otherwise be required.
The PoC was validated against modern Chrome (version 132+) on Android, where the FSA API permits web pages -- after a single user-granted permission -- to open and recursively write into the device's Pictures/DCIM root directory. This is a materially higher-impact target than the Desktop Pictures folder Check Point also tested, because a mobile photo library commonly contains years of irreplaceable personal media as well as photographed identity documents, financial statements, MFA/backup recovery codes, and medical records -- all reachable without any additional OS permission dialog beyond the initial FSA grant, and without installing an APK or exploiting any browser vulnerability. Desktop testing (Windows, Linux) confirmed the same mechanism against the local Pictures directory, judged lower-severity because that directory is less likely to hold irreplaceable or sensitive data than a mobile camera roll.
The underlying browser-level exposure is not itself novel: Check Point explicitly cites the 2023 USENIX Security paper "RøB: Ransomware over Modern Web Browsers" (Oz, Acar, et al., Florida International University, in collaboration with Google), which first demonstrated a browser-based ransomware strain (RøB) using the FSA API plus WebAssembly to encrypt files across local directories, cloud-sync folders (Google Drive, Dropbox, OneDrive, Box, MEGA), external storage, and network shares on Chrome and Edge, with Safari and Firefox unaffected because they do not implement the FSA picker APIs. Check Point's contribution is demonstrating that this previously academic/PoC-only attack class can now be reconstructed end-to-end -- lure, prompt-engineering the model past its refusal, working exploit code, and a viable mobile target (Android DCIM) -- by a lower-skilled actor using an off-the-shelf LLM (DeepSeek) rather than by security researchers.
No CVE was assigned, because the technique abuses an intentional, specified browser API rather than a memory-safety or logic vulnerability; the File System Access specification itself already recommends restricting picker access to sensitive OS-level directories (home, Desktop, Documents, Downloads, browser profile data, application/system directories), and current Chromium correctly blocks those sensitive paths -- but Pictures/Videos root access, including the Android DCIM equivalent, remains permitted by design, which is the gap this technique and RøB both exploit. No confirmed in-the-wild campaign using InfernoGrabber or an operationalized derivative had been observed at time of publication (2026-07-01); Check Point frames the finding as an early-warning proof of feasibility rather than an active campaign, but stresses that only minimal additional engineering effort separates the analyzed sample from a reliable, deployable browser ransomware kit.
MITRE ATT&CK techniques used in TL-2026-1035
Collection
T1005 Data from Local System; T1074 Data Staged; T1115 Clipboard Data; T1119 Automated Collection
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Credential Access
T1056.001 Keylogging; T1539 Steal Web Session Cookie
Execution
T1059.007 JavaScript; T1204.001 Malicious Link
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1189 Drive-by Compromise; T1566 Phishing; T1566.002 Spearphishing Link
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1531 Account Access Removal; T1565.001 Stored Data Manipulation
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1583.006 Web Services; T1585.001 Social Media Accounts; T1587.001 Malware
Reconnaissance
Affected products and versions in Browser-Only Ransomware via File System Access API Abuse
- Google — Chrome (Desktop)
Vulnerable versions: all versions implementing File System Access API - Google — Chrome for Android
Vulnerable versions: 132 and later (File System Access API support) - Microsoft — Edge (Chromium-based)
Vulnerable versions: all versions implementing File System Access API - W3C / WICG — File System Access API specification
Vulnerable versions: current spec permits Pictures/Videos root directory access - DeepSeek — DeepSeek V4 (Expert mode)
Vulnerable versions: generates working browser-ransomware PoC code when prompted with euphemistic/de-flagged wording
Remediation for Browser-Only Ransomware via File System Access API Abuse
Immediate actions
- Treat browser folder/file-access permission prompts (showDirectoryPicker/showOpenFilePicker) as high-stakes security decisions, not routine app behavior
- Do not grant unfamiliar or unverified websites access to directories containing personal photos, identity documents, MFA/recovery codes, financial records, or work data
- Review and revoke previously granted File System Access API permissions in chrome://settings/content/filesystem or equivalent Chromium site-settings UI
- Maintain current offline and cloud backups of Pictures/DCIM and other frequently targeted directories so encrypted files can be restored without paying a ransom
Workarounds
- Disable or restrict the File System Access API via enterprise Chrome policy (FileOrDirectoryPickerToDirectoryEnabled / FileSystemReadWriteExcludedPaths equivalents) for managed fleets where feasible
- Use Firefox or Safari for browsing untrusted AI-tool webpages, since neither currently exposes the showDirectoryPicker/showOpenFilePicker methods
- On Android, avoid granting broad Pictures/DCIM directory access to web apps; if functionality requires it, prefer single-file showOpenFilePicker grants over directory-level showDirectoryPicker grants where the site supports it
Longer-term hardening
- Prefer established, reputation-vetted native applications over ad-hoc web tools for processing sensitive files such as photo enhancement/upscaling
- Deploy endpoint/browser security controls capable of monitoring anomalous File System Access API usage patterns (mass sequential read+overwrite across a granted directory)
- Track LLM-assisted malware generation trends and adjust user-awareness training to include AI-branded utility lures as a phishing category
- Advocate for/adopt browser vendor mitigations restricting or rate-limiting FSA API write access to media directories, per the RøB paper's proposed defenses
Weaknesses (CWE) in Browser-Only Ransomware via File System Access API Abuse
CWE-451, CWE-284, CWE-1021
Timeline of Browser-Only Ransomware via File System Access API Abuse
- USENIX Security 2023 publishes 'RøB: Ransomware over Modern Web Browsers' (Oz et al., FIU, with Google), first academically demonstrating browser-native ransomware via the File System Access API and WebAssembly.
- Check Point Research begins collecting and classifying approximately 3,000 DeepSeek-attributed files from public telemetry over the following year, eventually classifying 1,383 as malicious or dangerous.
- Independent security researchers (CSIS, Tenable, Security Boulevard, Security Magazine) begin publishing findings that DeepSeek models can be prompted to generate functional malware, including keyloggers and ransomware, with fewer refusals than competing LLMs.
- Within the DeepSeek-attributed corpus, Check Point identifies InfernoGrabber v9.0 (SHA256 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5), a Flask-based malware sample disguised as a Discord avatar AI upscaler, attempting keylogging, clipboard monitoring, and wallet theft.
- Researchers determine most of InfernoGrabber's attempted capabilities fail under browser sandbox constraints, but its File System Access API file-access workflow is viable; they iteratively prompt DeepSeek V4 to build a reliable, working browser-ransomware PoC using a fake AI image-enhancement lure.
- Check Point validates the PoC against Chrome 132+ on Android, confirming web pages can access and encrypt the Pictures/DCIM root directory after a single user-granted File System Access permission, with no APK install or browser exploit.
- No confirmed in-the-wild deployment of InfernoGrabber or an operationalized derivative is identified at time of publication; the disclosure is treated as an early-warning proof of feasibility.
- Check Point Research (Alexey Bukhteyev) publishes 'Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique', disclosing the InfernoGrabber sample, the DeepSeek jailbreak-by-euphemism prompting pattern, and the Android DCIM PoC.
Sources cited for Browser-Only Ransomware via File System Access API Abuse
- Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
- RøB: Ransomware over Modern Web Browsers (USENIX Security '23)
- RøB: Ransomware over Modern Web Browsers (paper, Google Research)
- RøB: Ransomware over Modern Web Browsers (Cyber-Physical Systems Security Lab, FIU)
- RøB USENIX Security '23 slides (Harun Oz)
- Cybersecurity researchers spotlight a new ransomware threat - be careful where you upload files
- New ransomware over browser threat targets uploaded files
- DeepSeek Deep Dive Part 1: Creating Malware, Including Keyloggers and Ransomware
- DeepSeek Deep Dive: Creating Malware, Including Keyloggers and Ransomware (Tenable)
- Delving into the Dangers of DeepSeek
- DeepSeek can develop malware, cyber experts are sharing the risks
- Cybercriminals Eye DeepSeek, Alibaba LLMs for Malware Development
- DeepSeek-R1 Can Almost Generate Malware
- MDN: File System Access API
Threats related to Browser-Only Ransomware via File System Access API Abuse
- AI-Generated Browser-Only Ransomware Abuses Chrome File System Access API (InfernoGrabber 9000 / DeepSeek)
- InfernoGrabber v9.0: AI-Generated In-Browser Ransomware Abusing the Chromium File System Access API
- Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos
Detection coverage for TL-2026-1035
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1035 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.