DeepSeek Wrote Working Browser Ransomware Without Knowing the API Existed
Researchers at Check Point have turned up something genuinely unsettling: a Python malware sample, apparently generated by DeepSeek, that independently figured out how to weaponise a legitimate browser API to build functional ransomware. No native payload. No browser exploit. No root access required.
The file, uploaded to VirusTotal in January 2026 and dubbed InfernoGrabber v9.0 by its author, is a Flask web application posing as a Discord avatar upscaler. Behind that cover, it lifts Discord tokens, harvests credit card numbers and crypto seed phrases, logs keystrokes, and quietly activates the victim's webcam and microphone. There's also a Bitcoin ransom screen and an admin dashboard for the attacker to review stolen data.
The part that caught researchers' attention, though, was the ransomware mechanism itself. The malware uses the browser's File System Access API, a picker-based interface built into Chromium that lets web pages request access to local files with user permission. Once granted, the page enumerates files in the selected directory, reads and exfiltrates their contents, then encrypts and overwrites them before displaying an extortion note. The whole attack runs inside the browser.
Check Point says this is the first documented case of an AI model independently connecting a theoretical browser-only ransomware concept to a working attack chain. The technique had been dismissed by defenders as impractical given browser sandboxing. The AI apparently didn't get the memo.
What makes this particularly awkward is that the person who prompted DeepSeek almost certainly had no idea the File System Access API existed. Check Point's analysis suggests the model, when pushed to satisfy a vague but malicious request, effectively hallucinated its way into a real attack path. The attacker didn't need to know the underlying API. The model found it anyway.
The attack works on Chrome and Chromium-based browsers across Windows, macOS, Linux, Android, and Microsoft Edge. Check Point confirmed this through testing. iOS appears to be the one platform that escapes it, since Safari doesn't implement the same API. That's cold comfort given how much of the world runs Chromium.
The sample is one of 1,383 files Check Point classified as malicious or dangerous out of roughly 3,000 DeepSeek-attributed files analysed over the past year. The exact prompt used to generate this one is unknown.
DeepSeek's lower refusal rates for harmful requests are clearly a factor here. Unlike models from Anthropic or OpenAI, which require considerably more coaxing before they'll produce offensive code, DeepSeek apparently converts high-level malicious intent into functional attack code from a single broad prompt. Free access, broad regional availability, and minimal guardrails make it an attractive option for people who don't particularly care about AI ethics.
Check Point's head of research, Eli Smadja, put it plainly: the next novel attack technique might not come from a human researcher but from an AI hallucination that happened to be right about something. That's a difficult threat model to defend against.
For now, the browser-native ransomware pattern hasn't been seen in active campaigns. But the fact that a working proof of concept exists, apparently generated without specialist knowledge, suggests it's only a matter of time before someone less academically inclined gives it a run.