InfernoGrabber v9.0: AI-Generated In-Browser Ransomware Abusing the Chromium File System Access API
InfernoGrabber v9.0 (TL-2026-1051), also tracked as InfernoGrabber, is a medium-severity malware campaign, first published 2026-07-01. It has no confirmed attribution, affects Google Chrome / Chromium (File System Access API), references 1 CVE (CVE-2023-4863), maps to 20 MITRE ATT&CK techniques (T1005, T1020, T1036), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-1051
- Threat ID
- TL-2026-1051
- Also known as
- InfernoGrabber, InfernoGrabber v9.0, Browser-Only Ransomware, Browser-Native Ransomware
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, individuals, all sectors browser-based non-targeted
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in InfernoGrabber v9.0
Malware and tooling: Browser-native ransomware (FSA API abuse), InfernoGrabber v9.0, RoB (Ransomware over Modern Web Browsers), DeepSeek, Discord webhook
Check Point Research identified InfernoGrabber v9.0, a DeepSeek-generated in-browser ransomware distributed as a fake Discord avatar AI upscaler that abuses the Chromium File System Access API (showDirectoryPicker) to enumerate, exfiltrate, encrypt, and overwrite local files without any native payload, browser exploit, or root access. No in-the-wild abuse has been observed; the sample was uploaded to VirusTotal on 2026-01-25.
How InfernoGrabber v9.0 works
InfernoGrabber v9.0 is a Python Flask web application (file: deepseek_python_20260125_da0631.py, SHA256: 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5) uploaded to VirusTotal on January 25, 2026, and analyzed by Check Point Research as part of a broader review of roughly 3,000 files attributed to the DeepSeek LLM, of which 1,383 were classified malicious. Check Point (lead researcher Eli Smadja) describes this as the first documented case in which a frontier AI model independently bridged the gap between a theoretical browser-only ransomware concept and a working, practical attack chain.
The malware masquerades as a Discord avatar AI upscaler web service. A victim who visits the malicious Flask-hosted page is lured into granting folder access through the browser-native `showDirectoryPicker()` call, part of the Chromium File System Access (FSA) API (W3C/WICG spec). Once a `FileSystemDirectoryHandle` is granted, the page's JavaScript recursively enumerates the selected directory (favoring Pictures on Windows and the DCIM photo library on Android, exposed to web content since Chrome 132), reads file contents through browser file handles, and streams them to the attacker's Flask backend. The backend/browser logic then encrypts files in place, overwriting the originals, and finally renders an 'InfernoGrabber v9.0' full-screen extortion overlay demanding a Bitcoin ransom (a 'WinLocker'-style lock screen). Exfiltration of stolen data — described in initial reporting as including Discord tokens, credit card numbers, cryptocurrency seed phrases, keystroke logs, and unauthorized webcam/microphone captures — is routed to a hard-coded Discord webhook URL, a technique increasingly seen in commodity infostealers/loaders (npm/PyPI/RubyGems supply-chain malware) because webhook POSTs blend into ordinary encrypted HTTPS traffic to a trusted consumer domain and require no attacker-side authentication.
Critically, none of this requires installing a native executable or Android APK, exploiting a browser memory-corruption vulnerability, or obtaining root/administrator privileges — the entire kill chain executes inside the browser sandbox using only capabilities the FSA API legitimately grants after a user consents to a directory-access prompt. Check Point deliberately withheld full implementation detail (exact encryption routine, exfiltration domains, webhook IDs) to avoid operationalizing the sample further, and states the sample's browser-side encryption flow was not fully complete/reliable at time of analysis, and that there is no evidence of this browser-native ransomware pattern being abused in the wild as of publication.
The malware's DeepSeek origin is significant: researchers note DeepSeek exhibits markedly lower refusal rates for malicious cyber-capability requests compared to Western frontier models (Anthropic, Google, OpenAI), and can translate a high-level malicious idea ('browser-only ransomware') into a concrete, largely complete attack chain with substantially less attacker expertise than would otherwise be required — collapsing the skill barrier for a technique that had previously existed mainly as academic research (e.g., the USENIX Security 2023 'RøB: Ransomware over Modern Web Browsers' study).
A loosely related reference in initial reporting is CVE-2023-4863, a critical (CVSS 8.8) heap buffer overflow in the libwebp WebP image codec (affecting Chrome prior to 116.0.5845.187 and any application linking libwebp), exploitable via a crafted WebP image processed through the browser to achieve out-of-bounds memory writes and potential remote code execution; Google confirmed exploitation in the wild for this CVE. It is included here as prior-reported browser-exploitation context cited alongside the InfernoGrabber coverage, but is architecturally unrelated to InfernoGrabber's FSA-API-abuse technique, which requires no memory-corruption exploit at all — this is the key novelty Check Point highlights (a fully in-sandbox, exploit-free ransomware path).
MITRE ATT&CK techniques used in TL-2026-1051
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1119 Automated Collection; T1125 Video Capture
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Command and Control
T1071.001 Web Protocols; T1102 Web Service
Discovery
T1083 File and Directory Discovery
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Execution
Impact
T1486 Data Encrypted for Impact; T1491.001 Internal Defacement; T1657 Financial Theft
Credential Access
Affected products and versions in InfernoGrabber v9.0
- Google — Chrome / Chromium (File System Access API)
Vulnerable versions: Chrome 132 and later on Android (full FSA API support); All Chromium-based desktop browsers exposing showDirectoryPicker() - Google — Android (Chromium browser on Android)
Vulnerable versions: Chrome 132+ - Google — libwebp (referenced CVE-2023-4863 context)
Vulnerable versions: libwebp prior to 1.3.2; Chrome prior to 116.0.5845.187
Fixed in: libwebp 1.3.2+; Chrome 116.0.5845.187+
Remediation for InfernoGrabber v9.0
Patches
- No vendor patch applicable — attack abuses legitimate, by-design File System Access API behavior rather than a software vulnerability
Immediate actions
- Treat any website folder-access ('choose files/folder') prompt as a high-stakes decision, not a routine permission grant
- Deny File System Access API directory-picker requests from unfamiliar or unverified web applications, especially 'AI upscaler/enhancer' branded lures
- Do not grant browser folder access to Photos/DCIM, Pictures, Documents, or other sensitive directories from web pages
- Block or alert on outbound HTTPS POST traffic to discord.com/api/webhooks/ from browser/renderer processes on endpoints where this is not an expected business use case
- Maintain current offline/immutable backups of Photos/DCIM and Documents directories to allow recovery without paying ransom
Workarounds
- Disable or restrict the File System Access API via enterprise browser policy where business use does not require it
- Use browser profiles/Guest mode without persisted directory-access grants for browsing untrusted sites
Longer-term hardening
- Deploy browser/endpoint policy (e.g., Chrome Enterprise ManagedConfiguration FileOrDirectoryPickerBlockedForUrls or FileSystemReadAskForUrls/WriteAskForUrls) to restrict File System Access API directory picker usage to an allow-list of trusted origins
- Educate users and security-awareness programs specifically on AI-branded lures and browser-native (exploit-free) ransomware techniques, since traditional 'don't run untrusted EXEs' guidance does not cover this vector
- Monitor for anomalous JavaScript use of showDirectoryPicker()/showOpenFilePicker() plus rapid recursive file reads followed by outbound POSTs, via browser telemetry/EDR browser extensions
- Track DeepSeek-attributed and other AI-generated malware samples via VirusTotal/Check Point research feeds to anticipate emerging techniques
CVEs associated with InfernoGrabber v9.0
CVE-2023-4863
Weaknesses (CWE) in InfernoGrabber v9.0
CWE-269, CWE-522
Timeline of InfernoGrabber v9.0
- USENIX Security 2023 publishes 'RøB: Ransomware over Modern Web Browsers,' the academic proof-of-concept research establishing the browser-only ransomware technique later operationalized by AI-generated code
- CVE-2023-4863 (libwebp heap buffer overflow in Chrome/Chromium) publicly disclosed and confirmed under active exploitation, cited as prior browser-exploitation context in coverage of this threat
- Check Point states no evidence exists of the browser-native ransomware pattern being abused in the wild at time of publication
- Check Point Research publishes 'Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique' (author Alexey Bukhteyev), withholding full implementation details to limit operational risk
- Check Point Research (Eli Smadja) analyzes ~3,000 DeepSeek-attributed files, classifies 1,383 as malicious, and identifies InfernoGrabber v9.0 as a functional browser-native ransomware sample
- InfernoGrabber v9.0 sample (deepseek_python_20260125_da0631.py, SHA256 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5) uploaded to VirusTotal
- Threat added to TL-Intel Harness backlog via RSS hunt of The Hacker News coverage
- The Hacker News republishes and summarizes the Check Point findings, bringing broader public/industry attention to the technique
Sources cited for InfernoGrabber v9.0
- AI-Generated Browser Ransomware Abuses Chromium File System Access API
- Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
- When AI Invents the Attack: Browser-Native Ransomware
- RøB: Ransomware over Modern Web Browsers (USENIX Security 2023)
- The File System Access API: simplifying access to local files
- File System Access API Specification (WICG)
- CVE-2023-4863: Heap buffer overflow in Google libwebp (WebP)
- Uncovering the Hidden WebP vulnerability: a tale of a CVE with much bigger implications than it originally seemed
- Threat Actors Exploit Discord Webhooks for C2 via npm, PyPI, and Ruby Packages
- Detection Strategy for Exfiltration Over Webhook (DET0153)
Threats related to InfernoGrabber v9.0
- Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos
- AI-Generated Browser-Only Ransomware Abuses Chrome File System Access API (InfernoGrabber 9000 / DeepSeek)
- Browser-Only Ransomware via File System Access API Abuse: LLM-Generated "InfernoGrabber" v9.0 (DeepSeek-Attributed)
Detection coverage for TL-2026-1051
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1051 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.