Check Point turns an AI-generated malware idea into a browser-only ransomware proof of concept

A controlled Android demonstration used legitimate File System Access permissions to encrypt selected images without a native payload.

A dated report connected to the underlying research where available.

Published

Jul 1, 2026

DiggingBeagle

The report

Check Point Research published a controlled browser-only ransomware proof of concept on July 1 after analyzing an incomplete DeepSeek-attributed malicious sample.

The original sample mixed impossible browser claims with one practical idea: use the File System Access API to ask the user for folder access. Check Point then built a working Android demonstration in which a fake AI image-processing page received legitimate directory permission and encrypted selected images.

diagram

Browser-only ransomware proof-of-concept path

AI image tool lure
Victim expects local image processing
Folder permission prompt
Browser asks for directory access
Granted file handles
Page can read and modify selected files
Browser-side encryption
Controlled PoC overwrites selected images

AI image tool lure Folder permission prompt: request access
Folder permission prompt Granted file handles: user approval
Granted file handles Browser-side encryption: write files

Project-authored reconstruction from Check Point's July 1 defensive proof of concept. · Source: An AI-generated malware idea exposed a workable browser-only ransomware path

No APK installation, browser exploit or root access was required in the proof of concept. The user still had to grant the browser folder access.

Check Point says it had not observed the exact browser-native ransomware pattern adopted in the wild. The value of the research is therefore the attack path, not an incident count: a model-generated idea connected a harmful objective to a real web-platform capability that could produce local file damage after user approval.

Research behind this

Cite this record

DiggingBeagle. “Check Point turns an AI-generated malware idea into a browser-only ransomware proof of concept.” Published Jul 1, 2026. https://diggingbeagle.com/news/check-point-turns-ai-generated-malware-idea-into-browser-only-ransomware-poc/

Citation guidance

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.