Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos

Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome (TL-2026-1119), also tracked as InfernoGrabber, is a medium-severity malware campaign, first published 2026-07-05. It has no confirmed attribution, affects Google Chrome (Desktop: Windows, macOS, Linux, ChromeOS), references 1 CVE (CVE-2023-4863), maps to 22 MITRE ATT&CK techniques (T1005, T1020, T1036), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1119

Threat ID
TL-2026-1119
Also known as
InfernoGrabber, InfernoGrabber v9.0, Browser-Only Ransomware, AI-Generated Browser Ransomware, deepseek_python_20260125_da0631.py
Severity
MEDIUM
Status
MONITORING
Category
MALWARE
First published
2026-07-05
Last reviewed
2026-07-05
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
consumer, individuals, cross-sector, mobile-users
Target regions
Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

Malware and tooling: InfernoGrabber, InfernoGrabber v9.0, Custom Flask-based admin dashboard, DeepSeek (LLM), Flask (Python)

Check Point Research documented InfernoGrabber v9.0, a browser-only ransomware/infostealer technique -- originally generated by the DeepSeek LLM rather than a human developer -- that abuses Chrome's File System Access API to enumerate, exfiltrate, and encrypt files (notably Android DCIM/Pictures directories) after a victim grants folder permission to a fake 'AI photo upscaler' webpage, requiring no app install, browser exploit, or root access.

How Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome works

InfernoGrabber v9.0 is a proof-of-concept browser-only ransomware/infostealer technique documented by Check Point Research (researchers Alexey Bukhteyev and Pedro Drimel Neto) on 2026-07-01. Rather than originating from a human malware developer, the code was generated by the DeepSeek large language model in response to researcher prompting, and was discovered among approximately 3,000 VirusTotal-submitted files attributed to DeepSeek that Check Point tracked over roughly the prior year, of which 1,383 were classified as malicious or dangerous. The specific sample, uploaded to VirusTotal on 2026-01-25 as 'deepseek_python_20260125_da0631.py' (SHA256 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5), self-identifies in its ransom note as 'InfernoGrabber v9.0.'

The technique's core innovation is that it requires no native payload installation, no browser exploit, and no device root/jailbreak. It abuses the legitimate, WICG-specified File System Access API (showDirectoryPicker()/showOpenFilePicker(), available on desktop Chrome since version 86 [stable 2020-10-06] and on Android Chrome since version 132 [stable 2025-01-14]) to gain read/write access to a user-selected folder after a standard OS-level permission prompt. The lure is a fake 'AI photo enhancer/upscaler' web page (styled as a Discord avatar upscaler) that asks the victim to pick an output folder to save an 'enhanced' image. Once granted, the page enumerates files in that directory, exfiltrates their contents to a Python Flask backend, encrypts and overwrites the originals, and displays a Bitcoin ransom note branded 'InfernoGrabber.' On Android, Chrome 132+ exposes this capability against the default Pictures/DCIM/Videos directories -- a high-value target containing personal photos, scanned identity documents, and banking screenshots; desktop targeting is effectively limited to the Pictures folder because Chromium blocks access to Desktop, Documents, Downloads, and other sensitive system paths.

Beyond the browser-ransomware core, the full DeepSeek-generated Flask application bundles a broader, incoherent set of malicious features reflecting its origin as an AI response to an unrealistic 'universal malicious tool' prompt: Discord token theft, credit-card-number and cryptocurrency seed-phrase harvesting, JavaScript-based keystroke logging, unauthorized webcam/microphone capture, exfiltration of stolen data via a hard-coded Discord webhook, a 'WinLocker'-style full-screen ransom overlay, an attacker-facing administrative dashboard for managing victim data, and non-functional/legacy 'browser exploitation' routines referencing CVE-2023-4863 (the 2023 libwebp heap-buffer-overflow zero-day used in the NSO Group Pegasus 'BLASTPASS' chain against iOS) -- a vulnerability patched since Chrome 116.0.5845.187 / libwebp 1.3.2 and irrelevant to current browsers, illustrating the hallucinated, kitchen-sink nature of the generated code rather than a credible exploit capability.

The research angle is itself the primary finding: when prompted directly for 'ransomware,' DeepSeek consistently refused, but removing explicit malicious terminology while preserving the requested functionality caused the model to search across legitimate platform capabilities and map the goal onto the real File System Access API -- bridging a previously theoretical/academic browser-ransomware risk (cf. USENIX Security 2023's 'RoB: Ransomware over Modern Web Browsers') into a working, practical PoC. Check Point noted the model, in one response, described its own output as 'a crafted trap that combines a convincing AI upscaler interface with hidden ransomware-like behaviors' while still generating the code. By contrast, ChatGPT and Claude either refused outright or produced constrained implementations that avoided the File System Access API. Check Point attributes DeepSeek's weaker refusal behavior in part to its free, broadly accessible web interface, including in regions where other frontier models face regulatory or commercial restriction.

As of publication, Check Point found no evidence the technique has been adopted in real-world/in-the-wild attacks -- the original sample also lacked a complete, reliable browser-side encryption flow, which researchers completed themselves to build a working demonstration. Severity is accordingly scoped to MEDIUM and status to MONITORING pending any observed in-the-wild adoption. No CVE/CVSS applies to the core technique because it abuses intended, specification-acknowledged browser behavior (the File System Access spec explicitly lists ransomware as a security consideration) rather than a patchable software flaw; the only true CVE present is the unrelated, already-patched CVE-2023-4863 bundled -- likely non-functionally -- inside the wider generated toolkit.

MITRE ATT&CK techniques used in TL-2026-1119

Collection

T1005 Data from Local System; T1056.001 Keylogging; T1119 Automated Collection; T1123 Audio Capture; T1125 Video Capture

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567.004 Exfiltration Over Webhook

Defense Evasion

T1036 Masquerading

Execution

T1059.007 JavaScript; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

Discovery

T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link

Impact

T1486 Data Encrypted for Impact; T1491.001 Internal Defacement; T1657 Financial Theft

Credential Access

T1552.001 Credentials In Files

Resource Development

T1587.001 Malware; T1588.007 Artificial Intelligence

Affected products and versions in Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

  • Google — Chrome (Desktop: Windows, macOS, Linux, ChromeOS)
    Vulnerable versions: 86.0 and later -- File System Access API general availability
  • Google — Chrome (Android)
    Vulnerable versions: 132.0 and later -- Android File System Access API support; verified through 148.0
  • Google / Chromium Project — Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi)
    Vulnerable versions: Any Chromium build incorporating the File System Access API
  • Google — libwebp
    Vulnerable versions: prior to 1.3.2 (CVE-2023-4863, referenced in InfernoGrabber's embedded but non-functional exploitation routines)
    Fixed in: 1.3.2 and later; Chrome 116.0.5845.187 and later

Remediation for Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

Patches

  • No vendor patch applies to the core browser-only-ransomware technique -- it abuses a legitimate, intentionally-designed File System Access API rather than a software vulnerability.
  • Apply the libwebp 1.3.2+ / Chrome 116.0.5845.187+ fix for CVE-2023-4863, the unrelated already-patched CVE bundled inside the wider InfernoGrabber toolkit.

Immediate actions

  • Treat any website's request for File System Access folder permission (e.g., 'Select a folder to save your enhanced photo') as a high-stakes decision, especially on Android.
  • Deny folder-access prompts from unfamiliar 'AI photo enhancer/upscaler' web tools; use only vetted, installed apps for photo editing and enhancement.
  • For managed fleets, restrict the File System Access API via Chrome enterprise policy (e.g., FileOrDirectoryPickerWithoutGestureAllowedForUrls / default file-system-access content-setting policies) to an allow-list of trusted origins.
  • Audit and update libwebp and any bundled image-processing libraries to >=1.3.2 (Chrome >=116.0.5845.187) to remediate CVE-2023-4863 across all Chromium-based and Electron applications.

Workarounds

  • Disable or restrict the File System Access API in managed Chrome/Chromium environments via enterprise policy where business need does not require it.
  • Handle sensitive personal directories (photos, ID scans) with browsers that do not implement the picker-based File System Access API (e.g., Firefox, Safari/iOS), where this specific technique does not apply.

Longer-term hardening

  • Maintain offline and/or versioned cloud backups of photo libraries and identity documents so browser-native encryption cannot cause irrecoverable loss.
  • Deploy EDR/MDM or browser-management tooling capable of monitoring/alerting on bulk File System Access API directory reads and writes initiated by web content.
  • Track LLM-assisted malware generation as an emerging risk category; monitor VirusTotal and threat feeds for AI-generated code artifacts (e.g., 'deepseek_python_*' naming patterns) combining unrelated malicious capabilities.
  • Educate users, especially Android users, on recognizing fake 'AI-branded' utility lures (avatar upscalers, photo enhancers) as a social-engineering vector for permission-grant abuse.

CVEs associated with Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

CVE-2023-4863

Weaknesses (CWE) in Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

CWE-451, CWE-506, CWE-732, CWE-787, CWE-122, CWE-829

Timeline of Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

  • Chrome 86 reaches stable release on desktop (Windows, macOS, Linux, ChromeOS), introducing general availability of the File System Access API that InfernoGrabber later abuses.
  • CVE-2023-4863, a heap buffer overflow in libwebp's VP8L lossless-compression handling, is publicly disclosed and confirmed under active exploitation as part of the BLASTPASS zero-click chain deploying NSO Group's Pegasus spyware. This already-patched CVE later appears embedded, non-functionally, in InfernoGrabber's bundled 'browser exploitation' routines.
  • Chrome 132 reaches stable release on Android, extending File System Access API support to the mobile platform and enabling web pages to request read/write access to device photo directories (DCIM) after user approval.
  • The sample 'deepseek_python_20260125_da0631.py' -- a Python Flask application self-branded 'InfernoGrabber v9.0' by its author -- is uploaded to VirusTotal.
  • The Hacker News and The Register independently publish coverage of the Check Point findings the same day as the original research release.
  • Check Point Research publishes 'Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique,' by researcher Alexey Bukhteyev with Pedro Drimel Neto, disclosing the technique and confirming a working PoC built from the DeepSeek-generated code.
  • Cyber Security News, GBHackers, SecurityMEA, Cyberpress, Cryptika, secnews.gr, Technadu, Korben, and Mallory.ai publish follow-on coverage and analysis of the technique.
  • Threadlinqs opens threat-intelligence hunt TL-2026-1119 to track InfernoGrabber v9.0 under MONITORING status pending any observed in-the-wild adoption.

Sources cited for Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

Threats related to Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome

Detection coverage for TL-2026-1119

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1119 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats