When AI Invents the Attack: Browser-Native Ransomware

Security researchers at Check Point Research have uncovered a malware sample generated by DeepSeek that marks a new level of sophistication in the threat landscape: An AI model has independently bridged the gap between a purely theoretical, browser-based ransomware risk and a practical, functioning attack chain. This is the first documented case of its kind. The attack scenario requires no exploit, no app installation, and no technical expertise on the part of the attacker.

While analyzing nearly 3,000 files in public telemetry data attributed to DeepSeek, the research team came across a Python Flask application. It looked like a classic AI hallucination: It attempted to cram keylogging, the theft of login credentials, webcam recordings, and a ransom overlay onto a single web page—something most browsers simply do not allow. But amid this mess, the model got one crucial thing right: it called ’showDirectoryPicker(),« a legitimate browser API that allows a webpage to read, modify, and exfiltrate files from a folder selected by the user.

The result: Anyone who describes a malicious objective in simple terms receives a prototype that links that objective to an actual platform feature—without having known of its existence beforehand.

Check Point Research validated the technique with a controlled proof-of-concept: a fake AI image optimization tool called «AI Avatar Enhancer,» which uses the File System Access API to encrypt images in a selected directory. In a direct test with DeepSeek V4, the model rejected requests containing the term «ransomware»—but when presented with neutral wording, it consistently generated functional, browser-based ransomware code. The model described its own output as «a sophisticated trap that combines a convincing AI upscaler interface with hidden, ransomware-like behaviors.».

The workflow requires neither an APK installation nor a native payload, no browser exploit, and no root access—just a single permission request.

Chrome 132 introduced full support for file system access on Android. Tests with Chrome 148 have confirmed that websites can request access to the DCIM photo directory—the folder where personal photos, scanned IDs, bank screenshots, medical records, recovery codes, and travel documents are typically stored over the years. iOS Safari does not provide this API, which is why the technology cannot be used there.

Major AI providers such as Anthropic and OpenAI consistently reject requests related to ransomware, the theft of login credentials, or the use of malware. DeepSeek is less restrictive in this regard. The model is free, widely used, and easily accessible. In testing, a single, broadly worded prompt generated a complete malicious application—a process that would have required multiple manual requests and manual assembly with other models. This lower barrier to entry makes DeepSeek particularly attractive to attackers with limited technical knowledge.

In the past, discovering a new attack vector required expertise and creative human thinking. AI is fundamentally changing this dynamic: Malware generated in this way could shift the threat landscape from a limited number of reused malware families to a vast number of disposable, one-off artifacts—each with a unique combination of techniques. In doing so, AI not only reimagines existing attack patterns but also bridges the gap between purely theoretical risks and novel, practical attacks.

Eli Smadja, Group Manager at Check Point Research, : «We are currently witnessing a fundamental shift in the way new cyberattacks emerge. For the first time, we have evidence that an AI model can independently analyze legitimate platform functions and uncover a working attack technique. Until now, experts could only speculate this in theory, without even knowing that the underlying API existed. The barrier to carrying out complex attacks is dropping significantly, which has far-reaching implications for every company that integrates AI into its workflows, as well as for every mobile user who now carries their entire personal and professional life with them in a photo library.»

Every request from a browser to access a folder should be treated as a security-critical decision. It is important to verify which website is making the request, which folder is being selected, and whether write access is actually necessary. Websites should never be granted access to the main photo library, the DCIM folder, or directories containing sensitive documents such as identification cards, recovery codes, or banking screenshots.

Skepticism is warranted when it comes to AI- bait offers such as avatar upscalers or image optimizers. For important tasks, it is recommended to use reputable native apps or established cloud services. Regular offline and cloud backups ensure that encrypted files are never the only copy. Browsers and mobile operating systems should always be kept up to date. Companies should also use security solutions that identify and block malicious websites before suspicious permission requests even appear.

Source: Check Point Research Blog .