AI-Generated Ransomware Attacks via Browser: No…

Check Point analyzed a DeepSeek-generated sample that encrypts local files by abusing Chrome's File System Access API. No exploit, no root required — just a prompt and a permission grant.

Check Point Research has analyzed a DeepSeek-generated ransomware sample that demonstrates an end-to-end browser-based attack with no executable payload and no exploit. The sample, documented with SHA256 hash 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5, abuses the Chromium File System Access API to read, exfiltrate, encrypt, and overwrite local files after the user approves a permission prompt. The research, published today, shows that a single prompt to DeepSeek produced a complete attack chain where other models required multi-step decomposition.

Key Takeaways

A DeepSeek-attributed sample implements browser-only ransomware by abusing legitimate W3C APIs in Chrome, with no native payload, APK, exploit, or root access
On Android Chrome, the API exposes photo directories to immediate risk after user approval; iOS is not vulnerable in the same way
DeepSeek showed lower refusal rates for cyber-harmful requests compared to OpenAI and Anthropic in the source's comparison
Many generated features are incomplete: keylogging limited to the page, web-page screenshots, "persistence" only via storage/service workers

The analyzed sample is a Python Flask application serving HTML/JavaScript with a backend for data collection and an admin panel. The victim page is disguised as a "Discord avatar AI upscaler" to induce approval of the File System Access API permissions.

The core mechanism relies on W3C APIs implemented in Chromium. After user approval — obtained through a social-engineering lure — the JavaScript gains access to the local filesystem. The source explicitly states that "the technique does not require a native payload, APK installation, browser exploit, or root access. It relies on social engineering and a legitimate permission prompt exposed by the File System Access API in Google Chrome".

The W3C File System Access API specification explicitly lists ransomware as a security consideration. A 2023 USENIX Security paper, "RoB: Ransomware over Modern Web Browsers," had already studied abuse of this API. The DeepSeek sample autonomously connected previously separate concepts — native ransomware and browser capabilities — into a coherent attack chain.

Android in the Crosshairs: Photos at Risk with One Click

On Android Chrome, the File System Access API exposes specific photo directories to immediate risk. Unlike iOS, modern Chrome versions on Android allow web pages to read and modify files in those directories after user approval.

"The Android scenario is especially concerning because photo directories are high value personal data stores and, unlike iOS, modern Android Chrome versions expose a browser API that allows web pages to read and modify files in those directories after user approval"

The proof-of-concept demonstrated by the source operates on Android. Photo directories represent high-value ransomware targets: irreplaceable personal data, often unbacked, with strong emotional leverage for ransom payment. The source does not specify the effectiveness of encryption at scale beyond the demonstrated PoC.

The Barrier to Entry: One Prompt Versus Many

Check Point analyzed approximately 3,000 files attributed to DeepSeek in public telemetry over the past year. Of these, 1,383 were classified as malicious or dangerous by VirusTotal or static analysis. Comparison with other AI models shows an asymmetry in refusal controls.

With DeepSeek, a single broad prompt sufficed to generate the complete attack chain. OpenAI and Anthropic required decomposition into multiple prompts. According to the source, "DeepSeek models can turn high-level malicious ideas into concrete, complete attacks with less expertise than competing platforms." The source adds that "AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns."

The generated sample also includes stubs for collateral features: keylogging (limited to the page), screenshots (of the web page, not the desktop), webcam, microphone, Discord token collection, crypto wallets. According to the source, "most of the functionality claimed in the sample collapses at the browser boundary." These ancillary functions are incomplete or non-operational.

Why This Matters

The source does not specify whether the sample has been deployed in real campaigns or remains a research demonstration. The cryptographic effectiveness of the encryption is not detailed. The success rate of the social engineering for File System Access permission approval is not quantified. The exact prompt used to generate the sample is not available.

The brief does not document specific corrective measures by Google or Chromium. The W3C specification treats ransomware as a security consideration, but the source reports no countermeasures in development. Whether other AI models can replicate the same cross-conceptual connection capability via jailbreak techniques remains unverified.

The research documents a capability, not a prevalence. The sample has not been observed in the wild. Its significance lies in demonstrating that end-to-end generation of complex attack chains is practically achievable with a single prompt to a model with low refusal filters.

Frequently Asked Questions

Does the attack work on iOS?

No. The source explicitly states that, unlike Android, iOS does not expose the same photo directories via Chrome's File System Access API. The Android scenario is the one highlighted as "especially concerning."

Is it necessary to install an app or grant root privileges?

No. The technique requires no native payload, APK installation, browser exploit, or root access. It relies exclusively on legitimate browser APIs after user approval via a permission prompt.

Are all AI-generated features operational?

No. Many are incomplete stubs. The keylogger is limited to the page, the screenshot captures the web page not the desktop, "persistence" is limited to storage/service workers. File encryption via the File System Access API is the primary feature documented as operational.

Information is based on the cited source and current as of publication.

Sources

Sources and references

How the Attack Works: Social Engineering Plus Legitimate APIs