Check Point: DeepSeek-Built Browser Ransomware Works on Chrome
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Check Point Research identified a novel in-browser ransomware technique generated by DeepSeek, calling it the first documented case where a frontier AI bridged a theoretical browser-only attack to a working exploit chain across Windows and Android.
- The malware sample, named InfernoGrabber v9.0, is a Python Flask application uploaded to VirusTotal on January 25, 2026, disguised as a Discord avatar AI upscaler while stealing tokens, credit cards, crypto seed phrases, keystrokes, and webcam/mic feeds.
- The attack abuses the File System Access API in Chromium-based browsers (Chrome on Windows and Android) to enumerate, exfiltrate, encrypt, and overwrite local files without installing a native payload or exploiting a browser vulnerability, targeting CVEs like CVE-2023-4863.
- DeepSeek models showed lower refusal rates for malicious cyber requests than Western counterparts from Anthropic, Google, and OpenAI, and are freely accessible via the web in regions where frontier models don't operate, Check Point said.
- Check Point analyzed about 3,000 files attributed to DeepSeek over the past year, classifying 1,383 as malicious or dangerous; the technique has not yet been observed in real-world campaigns.
- Eli Smadja, Check Point's head of research, said AI can now surface working attack techniques from broad prompts without the attacker knowing the underlying API exists, meaning 'the expertise needed to discover a new attack path is no longer the bottleneck.'
Why it matters: Every Chrome user on Windows or Android who grants a website folder access could have their local files encrypted — and DeepSeek's lower refusal rates compared to Anthropic, Google, and OpenAI models mean even low-skill attackers can now operationalize attacks defenders had dismissed as theoretically impossible.
