The report
Check Point Research published a controlled browser-only ransomware proof of concept on July 1 after analyzing an incomplete DeepSeek-attributed malicious sample.
The original sample mixed impossible browser claims with one practical idea: use the File System Access API to ask the user for folder access. Check Point then built a working Android demonstration in which a fake AI image-processing page received legitimate directory permission and encrypted selected images.
diagram
Browser-only ransomware proof-of-concept path
- AI image tool lure
Victim expects local image processing
- Folder permission prompt
Browser asks for directory access
- Granted file handles
Page can read and modify selected files
- Browser-side encryption
Controlled PoC overwrites selected images
- AI image tool lure Folder permission prompt: request access
- Folder permission prompt Granted file handles: user approval
- Granted file handles Browser-side encryption: write files
No APK installation, browser exploit or root access was required in the proof of concept. The user still had to grant the browser folder access.
Check Point says it had not observed the exact browser-native ransomware pattern adopted in the wild. The value of the research is therefore the attack path, not an incident count: a model-generated idea connected a harmful objective to a real web-platform capability that could produce local file damage after user approval.