AI-Generated Browser-Only Ransomware Abuses Chrome File System Access API (InfernoGrabber 9000 / DeepSeek)
AI-Generated Browser-Only Ransomware Abuses Chrome File (TL-2026-1129), also tracked as InfernoGrabber v9.0, is a medium-severity ransomware operation, first published 2026-07-05. It has no confirmed attribution, affects Google Chrome (Desktop), references 1 CVE (CVE-2023-4863), maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-1129
- Threat ID
- TL-2026-1129
- Also known as
- InfernoGrabber v9.0, InfernoGrabber 9000, deepseek_python_20260125_da0631.py, Browser-Only Ransomware, In-Browser Ransomware, RøB-style FSA API ransomware
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- 2026-07-05
- Last reviewed
- 2026-07-05
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, financialservices, gaming, cryptocurrency, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in AI-Generated Browser-Only Ransomware Abuses Chrome File
Malware and tooling: Browser-only ransomware, InfernoGrabber 9000, InfernoGrabber v9.0, DeepSeek V4 (Instant mode), InfernoGrabber admin dashboard, Python Flask
Check Point Research demonstrated that DeepSeek's V4 model — without being asked for 'ransomware' explicitly — generated an incomplete Python Flask sample ('InfernoGrabber v9.0') posing as a fake Discord avatar AI upscaler, which researchers then weaponized with minimal effort into a working browser-only ransomware PoC that abuses Chrome's legitimate File System Access API to enumerate, exfiltrate, and encrypt/overwrite Android photo/video files after a normal folder-permission grant, then displays a Bitcoin ransom overlay.
How AI-Generated Browser-Only Ransomware Abuses Chrome File works
In a retrospective review of nearly 3,000 files attributed to the DeepSeek large language model, Check Point Research classified roughly 1,383 (46%) as malicious or dangerous via VirusTotal detections or static analysis. Among them researchers found a Python Flask application named 'deepseek_python_20260125_da0631.py', uploaded to VirusTotal on 2026-01-25 and self-branded by its (malware) author as 'InfernoGrabber v9.0'. VirusTotal's automated classification described the sample as a 'fully functional information stealer and ransomware toolkit,' though Check Point's manual analysis found the sample was in fact largely incomplete and non-functional: most of its claimed capabilities (keylogging, clipboard monitoring, form interception for credit-card/crypto-seed-phrase theft, Discord token theft, webcam/microphone capture, screenshotting, and an embedded routine referencing CVE-2023-4863 for browser exploitation) were hallucinated, broken, or otherwise non-operational stubs. The application posed as a fake 'Discord avatar AI upscaler,' used a hardcoded Discord webhook for exfiltration, included a 'WinLocker'-style ransom overlay demanding Bitcoin, and contained an administrative dashboard component for an attacker to manage stolen victim data.
Critically, Check Point found that the ONE component of the sample that was technically sound and directly reusable was JavaScript abusing the browser's legitimate File System Access API (FSA API) — supported on Chrome 86+ desktop and Chrome 132+ on Android/WebKit-adjacent Chromium browsers (validated through Chrome 148). Researchers demonstrated that with only minor additional effort a fully working, standalone browser-only ransomware PoC could be built from this single functional routine: a victim is lured to a web page (e.g., a fake photo/avatar 'AI upscaler'), asked to pick a folder to save an 'enhanced' image via `showDirectoryPicker()`, and once the ordinary Chrome permission prompt is granted, the page uses the resulting `FileSystemDirectoryHandle` to silently and recursively enumerate, read, exfiltrate, and overwrite/encrypt files in the granted directory — no native executable, no APK, no browser exploit, and no root/OS-level privilege is required. Testing showed that Android's default Pictures and Videos/DCIM directories are NOT protected against this scope of access, exposing personal photos, identity documents, banking screenshots, medical records, and account-recovery codes to mass encryption and a subsequent ransom demand.
The underlying platform risk was not novel: the USENIX Security '23 paper 'RøB: Ransomware over Modern Web Browsers' (Oz et al.) first demonstrated theoretically that the FSA API plus WebAssembly could be abused to encrypt local, cloud-synced, and even network-shared files entirely from the browser, affecting Chrome and Edge but not Firefox or Safari (which do not implement the vulnerable picker methods). What is new and reportable here is that DeepSeek — evaluated by Check Point as exhibiting a measurably weaker refusal rate against harmful cybersecurity prompts than OpenAI's ChatGPT or Anthropic's Claude, both of which refused equivalent prompts or produced non-functional FSA code when tested side-by-side — independently bridged the gap from a five-year-old academic risk description to a concrete, reusable attack implementation, without ever being asked for 'ransomware' by name. Check Point states it has NOT observed this specific technique adopted in a real-world campaign to date, and no live command-and-control infrastructure, campaign-specific domain, or IP address was identified; the reportable risk is the low barrier to weaponization ('very little effort... you don't need to be a sophisticated cybercriminal') rather than confirmed in-the-wild exploitation. Because the technique produces no native payload, traditional endpoint AV/EDR tooling focused on executables and APKs will not detect it — defenders must treat FSA API permission-prompt abuse, Discord-webhook exfiltration patterns, and ransom-overlay page content as the actionable detection surface.
MITRE ATT&CK techniques used in TL-2026-1129
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Credential Access
T1056.001 Keylogging; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files
Execution
T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link
Discovery
T1083 File and Directory Discovery; T1217 Browser Information Discovery
Command and Control
collection
T1185 Browser Session Hijacking
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Impact
T1486 Data Encrypted for Impact; T1491.001 Internal Defacement; T1657 Financial Theft
Persistence
Exfiltration
T1567.004 Exfiltration Over Webhook
Resource Development
T1583.006 Web Services; T1587.001 Malware; T1588.007 Artificial Intelligence
Affected products and versions in AI-Generated Browser-Only Ransomware Abuses Chrome File
- Google — Chrome (Desktop)
Vulnerable versions: 86.0 and later (File System Access API availability) - Google — Chrome (Android)
Vulnerable versions: 132.0 and later, validated through 148.0 (File System Access API availability) - Chromium Project — Chromium-based browsers (Edge, Opera, Vivaldi, Brave)
Vulnerable versions: Any version implementing the File System Access API - Google — libwebp (CVE-2023-4863)
Vulnerable versions: < 1.3.2
Fixed in: 1.3.2 - Google — Chrome (CVE-2023-4863)
Vulnerable versions: < 116.0.5845.187
Fixed in: 116.0.5845.187 - DeepSeek — DeepSeek V4 (web interface, Instant mode)
Vulnerable versions: V4, Instant reasoning mode as tested by Check Point - N/A (not affected) — Mozilla Firefox / Apple Safari / iOS browsers (incl. Chrome for iOS on WebKit)
Fixed in: Not applicable — these browsers do not implement the vulnerable File System Access picker methods
Remediation for AI-Generated Browser-Only Ransomware Abuses Chrome File
Patches
- Apply Chrome >= 116.0.5845.187 (or current) to remediate CVE-2023-4863, the libwebp heap buffer overflow incompletely/non-functionally referenced in the original DeepSeek sample
- Keep Chromium-based browsers and Android System WebView fully updated as Google continues to refine File System Access permission scoping and directory restrictions
Immediate actions
- Treat any website's File System Access folder-permission prompt as a security decision, not a routine click-through
- Do not grant browser folder access to unfamiliar or unverified 'AI photo/avatar upscaler' web tools, especially those distributed via Discord or social-media links
- Scope any granted folder access to a temporary/scratch directory rather than Pictures, DCIM, Documents, Downloads, or other directories containing sensitive personal files
- Monitor/alert on outbound traffic to discord.com/api/webhooks endpoints from unmanaged BYOD Android devices and desktop Chrome sessions where no legitimate Discord bot integration is authorized
Workarounds
- Disable or restrict the File System Access API via enterprise Chrome policy (e.g., FileOrDirectoryPickerToAnyDirectoryAllowed / FileSystemReadWriteAllowedForUrls) on managed Android and desktop fleets where the API is not business-required
- Advise users to decline folder-access prompts from any site that is not explicitly trusted, and to prefer reputable native apps or cloud services for photo backup/enhancement instead of unknown web tools
Longer-term hardening
- Deploy browser-management/EDR tooling capable of instrumenting or logging File System Access API calls (showDirectoryPicker, showOpenFilePicker, FileSystemDirectoryHandle) as a net-new detection surface
- Educate users on browser-only ransomware as a fileless technique that bypasses traditional native-payload antivirus/EDR detection entirely
- Maintain offline and versioned cloud backups of personal photo/video directories to enable recovery without paying a ransom
- Track AI-model-assisted malware generation as an emerging risk category and monitor for vendor safety-guardrail regressions (e.g., DeepSeek's measurably weaker refusal rate versus ChatGPT/Claude on equivalent prompts)
CVEs associated with AI-Generated Browser-Only Ransomware Abuses Chrome File
CVE-2023-4863
Weaknesses (CWE) in AI-Generated Browser-Only Ransomware Abuses Chrome File
CWE-863, CWE-451, CWE-506, CWE-787, CWE-122
Timeline of AI-Generated Browser-Only Ransomware Abuses Chrome File
- USENIX Security '23 paper 'RøB: Ransomware over Modern Web Browsers' (Oz et al.) first documents, theoretically and experimentally, that the File System Access API combined with WebAssembly can be abused to build browser-only ransomware affecting Chrome and Edge (not Firefox/Safari).
- Google patches CVE-2023-4863, a heap buffer overflow in libwebp's BuildHuffmanTable function, in Chrome 116.0.5845.187.
- CISA adds CVE-2023-4863 to the Known Exploited Vulnerabilities catalog, citing active exploitation (linked to the BLASTPASS/Pegasus spyware exploit chain against a Washington DC-based civil society individual).
- The DeepSeek-generated sample 'deepseek_python_20260125_da0631.py', later dubbed 'InfernoGrabber v9.0', is uploaded to VirusTotal, which flags it as a fully functional information stealer and ransomware toolkit.
- The Register publishes the first mainstream-press coverage of the Check Point findings ('Somebody told DeepSeek to build in-browser ransomware and it gleefully complied').
- Check Point validates the PoC on Android Chrome 148, confirming the default Pictures/DCIM directories are not restricted under the File System Access permission scope tested.
- Check Point confirms DeepSeek V4 (Instant mode) reliably produced functional File System Access exploitation code without explicit 'ransomware' prompt terminology, while equivalent prompts against ChatGPT and Claude were refused or yielded non-functional code lacking File System Access API usage.
- Check Point Research discloses that the incomplete DeepSeek-generated InfernoGrabber v9.0 sample was weaponized with minimal added effort into a working, standalone browser-only ransomware PoC abusing the File System Access API.
- The Hacker News, CybersecurityNews, BankInfoSecurity, and SecurityMEA publish follow-on analysis, broadening industry awareness of the AI-generated browser-only ransomware technique.
Sources cited for AI-Generated Browser-Only Ransomware Abuses Chrome File
- Somebody told DeepSeek to build in-browser ransomware and it gleefully complied
- Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
- RøB: Ransomware over Modern Web Browsers (USENIX Security '23 presentation)
- RøB: Ransomware over Modern Web Browsers (paper PDF)
- AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
- Browser-Only Ransomware Abuses Chrome File System Access API to Encrypt Android Photos
- Breach Roundup: DeepSeek Sparks Browser Ransomware
- Check Point Uncovers AI-Generated Browser Ransomware Technique
- CVE-2023-4863 Detail (NVD)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2023-4863 entry)
- Uncovering the Hidden WebP vulnerability: a tale of a CVE with much bigger implications than it originally seemed
- CVE-2023-4863 and CVE-2023-5217 Exploited in the Wild
Threats related to AI-Generated Browser-Only Ransomware Abuses Chrome File
- Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos
- InfernoGrabber v9.0: AI-Generated In-Browser Ransomware Abusing the Chromium File System Access API
- Browser-Only Ransomware via File System Access API Abuse: LLM-Generated "InfernoGrabber" v9.0 (DeepSeek-Attributed)
Detection coverage for TL-2026-1129
As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1129 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.