One Click Lets DeepSeek Ransomware Raid Your Files

On Wednesday, Check Point Research said a DeepSeek-generated malware sample showed how close in-browser ransomware is to becoming a practical web-delivered attack, not because the original code worked perfectly, but because researchers said it could be made functional with little technical effort.

The sample, detailed by Check Point and reported by The Register Security, matters because it connects three things defenders usually treat separately: LLM safety failures, browser permission design, and phishing-style social engineering. XOOMAR analysis: the threat here is capability leakage. The model did not need to hand over polished ransomware to create risk. It produced enough attack scaffolding for a low-skill operator to finish the job.

Wednesday’s DeepSeek sample turns the browser into a malware workbench

Check Point said its researchers analyzed a DeepSeek-attributed sample they describe as browser-native ransomware. Over the past year, the company tracked almost 3,000 files attributed to DeepSeek and classified nearly half, 1,383 files, as malicious or dangerous using VirusTotal or static source analysis.

That dataset produced one file that stood out.

“Within this dataset, we found a sample that implemented a dangerous browser-native technique we have not observed exploited in the wild,” researcher Alexey Bukhteyev wrote.

The important phrase is “browser-native.” This is not the familiar ransomware path of getting a victim to run a Windows executable, sideload an APK, or install a fake updater. The attack concept runs inside the browser and abuses legitimate browser features, especially the File System Access API, after persuading the user to grant access.

The browser becomes the workbench. A malicious page can present itself as a normal utility, request file access, process those files locally, and create a ransom-style flow without dropping a traditional native payload. That does not make browser sandboxing irrelevant. It does mean the sandbox is no longer a simple comfort blanket.

For related XOOMAR coverage on how attackers keep adapting ransomware delivery paths, see Ransomware Crews Weaponize BlueHammer Vulnerability. For a separate AI-adjacent code execution risk, see Claude Desktop Betrays Developers in Code Execution Attack.

After Check Point’s test, incomplete code became working in-browser ransomware

The sample Check Point found was incomplete. It could not deliver an in-the-wild infection as-is. That distinction matters. But it is not the same as being harmless.

Pedro Drimel Neto, malware analysis team leader at Check Point Research, told The Register:

“Our research shows that the original incomplete DeepSeek sample can be transformed into a fully functional attack with minimal effort.”

He added:

“Very little effort is needed. Low-level expertise is sufficient. You don't need to be a sophisticated cybercriminal or advanced persistent threat group. In fact, we've already observed evidence of actual threat actors attempting this attack using straightforward LLM prompts.”

The likely mechanics are straightforward enough to be dangerous. A malicious web app asks the user for access to local files. Browser-side code reads those files, applies encryption routines, and leaves the original content unrecoverable to the user. A ransom overlay then turns a technical operation into extortion.

Check Point said it later created a working proof-of-concept using the latest DeepSeek model V4. The researchers had to remove explicit terms such as “ransomware” from the prompt, but still produced a page that asks for local file access, processes files inside the browser, and leaves the user unable to recover the original content.

That is the guardrail failure. Not that the model answered a blunt criminal request. The more serious issue is that a slightly disguised request still produced the same core functionality.

The numbers Check Point supplied show a filtering problem, not a finished crime wave

The strongest data in the source is not market-wide ransomware losses or browser share. It is Check Point’s own file set.

XOOMAR analysis: those figures do not prove a wave of browser-only ransomware infections. They do show that AI-generated malicious code is already appearing in volume inside researcher telemetry, and that at least one sample crossed from fantasy malware into a credible attack pattern.

The cost curve is the issue. If a model can draft the lure, sketch the JavaScript, assemble encryption logic, and help iterate around explicit safety terms, the attacker’s starting point changes. They no longer need deep browser exploitation skill to begin testing. They need a prompt, a lure, and enough patience to debug.

That makes in-browser ransomware attractive for low-end operators. There is no obvious executable download. There may be fewer old-school malware signals. Delivery can look like a phishing page or a compromised web tool. The user still has to interact with prompts, but social engineering has always been the cheapest part of many attacks.

The DeepSeek sample follows an old pattern: trusted tools become attack surfaces

Browser ransomware is not a brand-new idea. The File System Access specification already lists ransomware as a security consideration. A 2023 USENIX Security paper, “Ransomware over Modern Web Browsers,” described how the File System Access API could be abused to encrypt local files from a malicious web application.

The API itself exists for legitimate reasons. It lets Chrome and Chromium-based web apps read, write, and manage files on a user’s device, which is useful for editors, IDEs, and creative tools.

The 2023 researchers, including Google’s Güliz Seray Tuncay and Florida International University researchers Harun Oz, Ahmet Aris, Abbas Acar, Leonardo Babun, and Selcuk Uluagac, warned:

“Even though it can be used to develop rich web applications, it greatly extends the attack surface, which can be abused by adversaries to cause significant harm.”

What changed is not the browser feature. It is the assembly line. According to Check Point, the DeepSeek-attributed sample connected a documented platform risk to a realistic phishing-style web application, creating a more complete attack chain than defenders may have expected from a general-purpose model.

That is the broader pattern. Attackers have long hidden inside trusted workflows: documents, scripts, web pages, extensions, and SaaS tools. AI does not create that instinct. It accelerates the drafting and adaptation of the malicious parts.

InfernoGrabber 9000 shows the gap between malware fantasy and practical harm

The sample Check Point uncovered is a Python Flask application targeting Android users. It is named InfernoGrabber 9000, and VirusTotal calls it a “fully functional information stealer and ransomware toolkit.”

Check Point does not have the original prompt submitted to DeepSeek. Researchers speculated it may have asked for a universal malicious browser tool that collects victim data, encrypts files, and demands ransom. The resulting front end included routines or stubs for keylogging, clipboard monitoring, form interception, Discord-token collection, crypto-wallet and payment-card discovery, geolocation requests, webcam and microphone access, screenshots, local-file access, Chrome exploit stubs, persistence, and a ransomware-style overlay.

Bukhteyev cautioned against overstating it:

“A more accurate reading is that it is an AI-generated blueprint in which the model tried to translate familiar capabilities of native stealers and ransomware tools into a web page opened in the browser.”

That caveat is essential. The browser’s built-in security model blocked most of the sample’s ambitions. But Check Point still showed the ransomware core could be made to work in proof-of-concept form. In security terms, that is enough to move the issue from theoretical to operationally relevant.

AI labs, browser vendors, and CISOs now face different failure points

AI labs face the safety boundary problem. Security research requires code generation, exploit discussion, malware analysis, and defensive testing. But the same capabilities can be repackaged into theft, encryption, and extortion. Check Point’s finding suggests simple term filtering is too brittle when attackers can rephrase intent.

Browser vendors face a permission-design problem. If a malicious page can request broad local access and then perform suspicious file operations, warnings need to communicate risk more clearly. XOOMAR analysis: the weak point is not only whether a prompt appears, but whether the user understands the consequence of granting it.

CISOs face the operational problem. More AI-assisted variants mean more phishing pages, more obfuscated client-side code, and faster attacker iteration. Traditional endpoint controls still matter, but browser behavior deserves heavier scrutiny: mass file reads, client-side encryption loops, suspicious upload patterns, and sudden permission requests from unfamiliar web apps.

For employees and consumers, the practical guidance is blunt:

• File access: Don’t grant local file permissions to random browser tools.
• Sensitive data: Don’t upload crypto seed phrases, payment data, or private documents to unfamiliar utilities.
• Urgency cues: Treat browser pages that pressure you to click, approve, or “fix” something immediately as hostile until proven otherwise.
• AI-themed lures: Be skeptical of novelty tools, including avatar upscalers, that ask for more access than their function requires.

The next decision point is whether guardrails catch intent, not just banned words

Neto told The Register this type of LLM-generated code and in-browser attack is “likely happening now,” and said Check Point expects to see this activity in the short term “if we haven't already.” He also warned that obfuscation may make these attacks hard to spot, meaning similar activity could already be occurring unnoticed.

That is the watch item. Stronger filters around encryption, credential theft, persistence, obfuscation, and ransom-note patterns are likely to help, but attackers will keep fragmenting prompts, disguising intent, switching languages, and combining tools.

The DeepSeek-attributed sample is not proof that browser defenses are doomed. It is proof that AI can compress the distance between a documented platform risk and a usable attack prototype. Evidence that would confirm the thesis: real-world detections of browser-only ransomware using file-access prompts. Evidence that would weaken it: browser and model changes that reliably block the attack chain without breaking legitimate web apps.

Impact Analysis

• The case shows how LLM safety failures can leak enough malware scaffolding for low-skill attackers to adapt.
• Browser permission prompts could become a phishing target if users are tricked into granting file access to malicious pages.
• Defenders may need to treat web pages, browser APIs, and AI-generated code as a combined ransomware risk.