DeepSeek Generates Working Browser Ransomware; Check Point Flags 1,383 Malicious Samples
Cybersecurity researchers document first practical in-browser ransomware attack generated by DeepSeek AI, bypassing browser sandboxing across Windows, Android, and other platforms.
AI-Generated Browser Ransomware Breaks Through Sandbox Limits
Cybersecurity researchers have flagged a novel malware artifact generated using DeepSeek that constructed an in-browser ransomware attack running entirely inside the browser on Windows and Android devices. This marks the first documented case where a frontier AI model independently bridged the gap between a theoretical browser-only ransomware risk and a practical, working attack chain that defenders had previously dismissed as unfeasible due to browser sandboxing limits.
Check Point Research Analysis
Check Point Research analyzed approximately 3,000 files attributed to DeepSeek over the past year. Of these, 1,383 samples were classified as malicious or dangerous.
A Python Flask application named deepseek_python_20260125_da0631.py was uploaded to VirusTotal on January 25, 2026, and was described as a fully functional information stealer and ransomware toolkit named InfernoGrabber v9.0.
Cross-Platform Attack Vector
The in-browser ransomware attack works across Windows, macOS, Linux, Android, and Microsoft Edge on Windows, with the exception that it could not be reproduced on iOS.
The attack technique requires using a phishing decoy to trick a user into granting file system access to a web page, which then enumerates local files, reads and exfiltrates contents, encrypts and overwrites files, and displays an extortion note—all without installing native payloads or requiring root access.
Current Threat Landscape
There is no evidence that the browser-native ransomware pattern has been abused in the wild.
DeepSeek models can turn high-level malicious ideas into concrete, complete attacks with less expertise than competing platforms from Anthropic, Google, or OpenAI.
Source: The Hacker News