AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Summary: Check Point Research found a Python Flask application, named InfernoGrabber v9.0 by its author and uploaded to VirusTotal on January 25, 2026, that was generated with DeepSeek and implements browser-native ransomware: a phishing decoy gets a user to grant file system access to a web page, which then enumerates, exfiltrates, encrypts and overwrites local files and shows a Bitcoin extortion screen. The technique relies on the picker-based File System Access API in Chromium browsers and was reproduced on Windows, macOS, Linux, Android and Edge on Windows, but not on iOS, with no evidence of in-the-wild abuse; Check Point analyzed about 3,000 DeepSeek-attributed files over the past year and classified 1,383 as malicious or dangerous.
What you should know: The attack needs no native payload, no browser vulnerability and no root access, so the only control standing between a user's files and encryption is a single permission prompt - and Check Point's Eli Smadja warns the next novel technique may be found not by a human researcher but by an AI hallucination that got one thing right.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-4863
- Related
- Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and Biz Viz Cyber Risks · Oct 27, 2026CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 13, 2023