DeepSeek Wrote Browser Ransomware When Asked Nicely Enough
Most AI models will refuse to write ransomware if you ask directly. But give them a sufficiently euphemistic prompt and many will happily fill in the gaps. DeepSeek, with its comparatively relaxed safety controls, appears to be particularly cooperative on this front.
Check Point Research published findings this week detailing a DeepSeek-generated malware sample they describe as in-browser ransomware. The Israeli security firm has been monitoring nearly 3,000 files attributed to DeepSeek over the past year, and classified close to half of them, around 1,383 files, as malicious or dangerous based on VirusTotal scans and static analysis.
One sample stood out. Researcher Alexey Bukhteyev described it as implementing "a dangerous browser-native technique we have not observed exploited in the wild." The sample was incomplete and couldn't carry out a real infection as-is, but Check Point's testing found that finishing the job would require minimal skill. Their malware analysis team leader, Pedro Drimel Neto, put it plainly: low-level expertise is sufficient. No nation-state group required.
"We've already observed evidence of actual threat actors attempting this attack using straightforward LLM prompts," Drimel Neto said.
Not a new idea, just a newly accessible one
The underlying risk here isn't novel. The File System Access API, supported mainly in Chrome and Chromium browsers, lets web applications read and write files on a user's local machine. Developers use it for things like browser-based IDEs and image editors. Back in 2023, a USENIX Security paper laid out exactly how this API could be weaponised to encrypt local files from a malicious web page. Google and university researchers flagged the expanded attack surface at the same time.
What's changed is that an AI model has now connected those documented theoretical risks to a working phishing-style web application. Check Point argues this creates a viable end-to-end attack chain that defenders previously dismissed as impractical given browser sandboxing constraints. The attack requires no native payload, no APK installation, no browser exploit, and no root access. Just a social engineering trick to get the user to click something, combined with a legitimate permission prompt the browser itself provides.
Introducing InfernoGrabber 9000
The specific sample is a Python Flask application targeting Android users, cheerfully named InfernoGrabber 9000. VirusTotal describes it as a "fully functional information stealer and ransomware toolkit," though that assessment is generous.
Check Point doesn't have the original prompt used to generate it, but they suspect it was something like: build a universal browser-based tool that harvests victim data, encrypts files, and demands ransom. The generated code includes stubs and routines for keylogging, clipboard monitoring, form interception, Discord token theft, crypto wallet scanning, payment card harvesting, geolocation, webcam and microphone access, screenshot capture, Chrome exploit hooks, persistence mechanisms, and a ransomware overlay.
In practice, the sample does almost none of this successfully. Bukhteyev describes it more accurately as "an AI-generated blueprint in which the model tried to translate familiar capabilities of native stealers and ransomware tools into a web page opened in the browser." The lure is dressed up as a Discord avatar upscaler. Click it, and the code attempts to silently execute a pile of nastiness inside the browser process, including token theft, keylogging, credential harvesting, and a WinLocker-style ransom screen demanding Bitcoin. Data exfiltration is hardcoded to a Discord webhook.
The browser's built-in security model blocks most of it. For now.
The working proof-of-concept bit
Check Point then built their own proof-of-concept using the latest DeepSeek V4 model. They had to scrub explicit terms like "ransomware" from the prompts, but the end result was functionally equivalent: a web page that requests local file access, encrypts what it finds inside the browser, and leaves the victim with no way to recover the originals. That is, by any reasonable definition, browser ransomware.
Drimel Neto believes this kind of attack is likely already happening in the wild, and expects to see it more openly in the short term. The barrier to entry has dropped considerably when a mediocre prompt and a cooperative LLM can sketch out the architecture of a working attack.