Full Report
Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, large language models have reshaped software development, and malware development has followed the same path. Check Point Research has documented this trend from early experiments showing that AI systems could generate offensive components, to cases of cybercriminals using ChatGPT to create malicious tools, and […] The post Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique appeared first on Check Point Research.
Analysis Summary
# Tool/Technique: Browser-Only Ransomware (LLM-Assisted)
## Overview
This is a novel, browser-native attack technique that leverages the legitimate **File System Access API** to perform ransomware-style operations (encryption and exfiltration) without requiring a native binary, APK installation, or traditional system exploitation. Originally identified as an "AI hallucination" during research with DeepSeek, it was matured into a practical attack vector that targets sensitive user directories through the browser.
## Technical Details
- **Type**: Technique / Browser-Native Malware
- **Platform**: Cross-platform (specifically verified on Android Chrome and Desktop Chrome)
- **Capabilities**: File encryption, data exfiltration, social engineering, folder-level file modification.
- **First Seen**: July 1, 2026 (Research Publication Date)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing (Social engineering to lure users to a malicious site)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious Link
- **TA0009 - Collection**
- T1213 - Data from Information Repositories (Accessing photo/document directories)
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact (Ransomware behavior via API)
- T1537 - Transfer Data to Cloud Account (Exfiltration via web requests)
## Functionality
### Core Capabilities
- **File System Access API Abuse**: Requests user permission to access entire directories (e.g., `/DCIM` or "Photos") rather than individual files.
- **In-Browser Encryption**: Uses JavaScript-based cryptographic libraries to encrypt files directly within the browser memory and overwrite the originals.
- **Zero-Payload Execution**: Does not require a traditional "malware.exe" or "malware.apk"; the entire logic resides in the website's JavaScript.
- **Persistence-less Impact**: The damage is done during the session; the attacker does not need to maintain a persistent foothold on the OS to cause permanent data loss.
### Advanced Features
- **LLM-Optimized Generation**: Code for this technique can be generated end-to-end by modern LLMs (like DeepSeek) with lower refusal rates than other frontier models.
- **Social Engineering Integration**: Uses "AI Image Enhancement" or similar lures to provide a plausible reason for requesting folder-level write permissions.
## Indicators of Compromise
- **File Hashes**: N/A (Dynamic JavaScript-based attack; no static native binary).
- **File Names**: Encrypted files may feature new extensions (e.g., `.locked`, `.encrypted`).
- **Registry Keys**: N/A.
- **Network Indicators**:
- Exfiltration endpoints (C2): `[variable-attacker-domain].com`
- Content Delivery Networks (CDNs) hosting malicious JS: `hxxps[://]cdn[.]attacker-site[.]com/scripts/processor.js`
- **Behavioral Indicators**:
- High CPU usage in a single browser tab.
- Browser prompts requesting "View and Edit" permissions for sensitive folders like "Photos," "Documents," or "Desktop."
- Rapid sequential file modification events initiated by the browser process.
## Associated Threat Actors
- **Research Discovery**: Alexey Bukhteyev (Check Point Research).
- **Potential Users**: Low-to-mid-tier cybercriminals utilizing LLMs to lower the development barrier for browser-based attacks.
## Detection Methods
- **Signature-based**: Detection of specific JavaScript patterns associated with iterative file writing/encryption via the File System Access API.
- **Behavioral detection**:
- Monitoring for unusually high volumes of `FileSystemWritableFileStream.write()` calls.
- EDR/Endpoint security monitoring for browser processes overwriting numerous files in user-profile directories.
- **Browser Protection**: Web filtering for domains known to host malicious LLM-generated scripts.
## Mitigation Strategies
- **User Education**: Train users to treat browser folder-access prompts as high-risk security decisions.
- **Administrative Policy**: Use Group Policy (GPO) or MDM profiles to disable the File System Access API in environments where it is not required.
- **Least Privilege**: Avoid storing sensitive, irreplaceable data in default directories (like "Downloads") that users are more likely to grant access to.
- **Browser Configuration**: Set Chrome/Edge policies to "Block the File System Access API" (`DefaultFileSystemReadGuardSetting` / `DefaultFileSystemWriteGuardSetting`).
## Related Tools/Techniques
- **VoidLink**: An AI-generated malware framework previously documented by Check Point.
- **Drive-by Downloads**: While different, this shares the "initial access via web" commonality.
- **Man-in-the-Browser (MitB)**: Shares the trait of operating entirely within the browser context.