[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvdsMYbcP9o96BVZ7q_hZc4N2OeNYZD4GHXkszFukpRg":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e68d3c75-f426-4488-8753-ba7910968953","AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android","ai-generated-browser-ransomware-abuses-chromium-api-on-windows-and-android-b2ff03","Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining \"unrealistic browser-malware concepts with a real browser capability\" to turn it into a working ransomware technique that runs entirely inside the browser on both Windows and Android devices. \"This is the first documented case where a frontier AI model","Researchers at Check Point discovered a Python Flask malware artifact (InfernoGrabber v9.0) generated by DeepSeek AI that implements a novel in-browser ransomware technique. The malware uses phishing to trick users into granting file system access via the Chromium File System Access API, then exfiltrates, encrypts, and overwrites files—all without requiring native payload installation or root access. This marks the first documented case of a frontier AI model independently discovering a practical attack chain that bridges theoretical browser-only ransomware risks with working exploitation on both Windows and Android.","DeepSeek AI generates first functional browser-based ransomware exploiting Chromium File System API.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fai-generated-browser-ransomware-abuses.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg4BJdHYquuxXoz8n0LhMEmm9KPcWcMC57w4LnqbMNCPXMAFdS95ys3zE6F5jZOvSKwsVWp6t3z8pVImRJ3Nvxgkr4QiPI5O06zJywlL5uuBIU2G0ZtPucYq80Z_G-PnVzjYfChzbnpLxGyD2PpbH8VdLWjIuNLt0RoAe5Q8mVulX2s_4Ueg7XR0pxZVwKn\u002Fs1600\u002Fchrome-ransomware.jpg","2026-07-01T12:59:19+00:00","2026-07-01T16:00:23.638162+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"DeepSeek","vendor",{"name":21,"type":19},"Check Point",{"name":23,"type":19},"Google",{"name":25,"type":26},"Chromium File System Access API","technology",{"name":28,"type":29},"Chrome","product",{"name":31,"type":26},"Discord webhooks","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2023-4863","Browser vulnerability targeted by the malware for exploitation",{"type":36,"value":59,"context":60},"InfernoGrabber v9.0","AI-generated ransomware toolkit with information stealing and browser-based encryption capabilities",{"type":36,"value":62,"context":63},"WinLocker","Ransomware screen component demanding Bitcoin ransom",[21,23,18],{"controls":66,"vendors":153},[67,96,124],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":52,"name":97,"problem":98,"products":99},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[154],{"slug":155,"name":21,"logo_path":156,"roles":157},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":177},"ai-generated-browser-ransomware-exploits-chromium-api-without-installation","AI-Generated Browser Ransomware Exploits Chromium API Without Installation","The InfernoGrabber v9.0 malware demonstrates how AI models can now autonomously discover and implement novel attack chains, lowering the barrier for sophisticated threat development. By abusing the legitimate Chromium File System Access API—a browser feature designed for productivity—attackers can encrypt and exfiltrate files without ever installing native malware or requiring elevated privileges, bypassing traditional endpoint defenses. This is particularly dangerous because users are socially engineered into voluntarily granting file system permissions through phishing, meaning the attack succeeds through misplaced trust rather than technical exploitation. The cross-platform nature of the attack (Windows and Android) dramatically expands the potential victim pool and underscores that browser-based attack surfaces are severely underestimated in most threat models.",[164,165,166,167,168,169,170,171,172,173,174,175,176],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 11: Data Recovery","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Awareness Training","NIST SP 800-53 CP-9: System Backup","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","GDPR Article 32: Security of Processing (data protection by design)","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1486: Data Encrypted for Impact","MITRE ATT&CK T1185: Browser Session Hijacking",{}]