The original sample was noisy. It claimed capabilities that a normal web page cannot perform and mixed browser-limited stubs with malware-style features. One part was different: it reached for the File System Access API, a legitimate browser capability that can read and modify files after a user grants folder access. Check Point used that idea to build a…
Inspect the ClaimsCase · DiggingBeagle record
An AI-generated malware idea exposed a workable browser-only ransomware path
Check Point turned an incomplete DeepSeek-attributed sample into a controlled Android proof of concept that used legitimate browser folder permissions to encrypt selected images without a native payload.
Scope
Defensive research and proof of concept. Check Point says it had not observed the exact browser-native technique adopted in the wild.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- WITH AI
Basis and provenance
Check Point's controlled browser proof of concept required a user folder grant and did not exploit the browser. The recorded no-in-the-wild claim bounds the demonstrated technique separately from attributed malware samples. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-POC · CLM-SAMPLE · CLM-DATASET · CLM-NOT-WILD · Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
At a glance
Browser permission prompts can be security boundaries when web applications gain durable file-write access. AI lowers the effort required to discover and combine those primitives, but a controlled PoC should remain clearly separated from incident evidence.
Read the implicationsThe exact browser-native technique was not reported as an in-the-wild campaign in the source. The original DeepSeek-attributed sample did not reliably implement every claimed capability.
Limits and uncertaintyFull account
The original sample was noisy. It claimed capabilities that a normal web page cannot perform and mixed browser-limited stubs with malware-style features. One part was different: it reached for the File System Access API, a legitimate browser capability that can read and modify files after a user grants folder access.
Check Point used that idea to build a controlled proof of concept on Android Chrome. A fake image-processing workflow gave the victim a plausible reason to approve folder access. After the permission was granted, the page could encrypt pictures inside the selected directory without installing an APK, exploiting the browser or obtaining root access.
The research is useful because it shows a model connecting an unrealistic malicious objective to a real platform primitive. It is not evidence of a deployed ransomware campaign. Check Point explicitly says the original sample was incomplete and that it had not observed the exact browser-native pattern in the wild.
Mechanism and trust boundary
- 01
Present an AI-themed browser lure
A page gives the user a plausible reason to process local images.
Boundary: social engineering / browser permission
- 02
Request directory access
The browser exposes a legitimate File System Access permission prompt.
Boundary: web page / local files
- 03
Receive user-approved file handles
The page gains read/write access to the selected directory after approval.
Boundary: permission / file authority
- 04
Encrypt selected images
The controlled proof of concept modifies files through the granted browser API.
Boundary: browser capability / local damage
Timeline
- Jul 1, 2026Event type unspecified
Check Point publishes browser-only ransomware research
The report documents the incomplete sample and controlled Android proof of concept.
Claims & evidence
CLM-POCCheck Point built a controlled proof of concept in which an Android Chromium browser granted folder access and the page encrypted selected images without installing a native application or exploiting the browser.supported
Basis: reported finding · active
- supportsBrowser-Only Ransomware: From LLM Hallucinations to a Practical Attack Techniqueprimary
In-Browser Ransomware on Android
CLM-SAMPLECheck Point reports finding a DeepSeek-attributed malicious sample that connected a broad browser-malware idea to the File System Access API, although the original sample was incomplete.supported
Basis: reported finding · active
- supportsBrowser-Only Ransomware: From LLM Hallucinations to a Practical Attack Techniqueprimary
Key takeaways and Noisy Sample section
CLM-DATASETCheck Point says it analyzed nearly 3,000 DeepSeek-attributed files in public telemetry and classified 1,383 as malicious or dangerous by VirusTotal detection or static source analysis.supported
Basis: reported finding · active
Recorded measurement: 1383 files classified malicious or dangerous · Check Point public-telemetry review using VirusTotal detection or static source analysis
- supportsBrowser-Only Ransomware: From LLM Hallucinations to a Practical Attack Techniqueprimary
Introduction and telemetry dataset
CLM-NOT-WILDCheck Point says it found no evidence that this browser-native ransomware pattern had been adopted as an in-the-wild malware technique at the time of analysis.supported
Basis: reported finding · active
Scope: Absence of evidence in the Check Point dataset is not proof that no independent use exists.
- supports
Evidence visuals
diagram
Browser-only ransomware proof-of-concept path
- AI image tool lure
Victim expects local image processing
- Folder permission prompt
Browser asks for directory access
- Granted file handles
Page can read and modify selected files
- Browser-side encryption
Controlled PoC overwrites selected images
- AI image tool lure Folder permission prompt: request access
- Folder permission prompt Granted file handles: user approval
- Granted file handles Browser-side encryption: write files
Implications
Browser permission prompts can be security boundaries when web applications gain durable file-write access. AI lowers the effort required to discover and combine those primitives, but a controlled PoC should remain clearly separated from incident evidence.
Controls and mitigations
- Treat browser directory-write prompts as high-impact security decisions.
- Avoid granting untrusted web tools access to sensitive or irreplaceable folders.
- Maintain independent backups so file encryption does not become irreversible.
Unknowns and contradictions
- The exact browser-native technique was not reported as an in-the-wild campaign in the source.
- The original DeepSeek-attributed sample did not reliably implement every claimed capability.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Sep 25, 2026 · Published version · material revision · revision 37Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims