Browser-Based Ransomware Exploits File System Access API in Novel Attack Researchers have uncovered a new ransomware technique that operates entirely within a browser, leveraging the File System Access API to encrypt or exfiltrate files without requiring native malware, exploits, or elevated privileges. The proof-of-concept (PoC), attributed to AI-assisted development by DeepSeek, demonstrates how malicious actors can turn theoretical browser-based threats into practical attacks. The attack begins with a social engineering lure a fake AI image-enhancement or upscaler web app designed to trick users into granting folder-level access. Once a victim selects a directory (such as a photo folder), the malicious page enumerates, reads, and encrypts files using browser file handles, then displays a ransom note. The technique bypasses traditional defenses, as it relies on legitimate browser APIs and user-granted permissions rather than dropped binaries or exploits. A key concern is the attack’s effectiveness on Android, where Chromium-based browsers (including Chrome) allow access to sensitive directories like DCIM and Pictures, which often contain irreplaceable personal data. While Safari and Firefox do not widely expose the same API primitives, the risk is concentrated where Chrome dominates. The DeepSeek PoC, dubbed InfernoGrabber, used a Discord-themed frontend with `showOpenFilePicker()` and `showDirectoryPicker()` to obtain file handles, demonstrating an end-to-end attack chain. Though the API restricts arbitrary disk access, targeting user-facing folders like Pictures and Downloads is sufficient for high-impact outcomes when paired with convincing social engineering. This attack highlights a growing challenge: AI can rapidly translate abstract malicious concepts into operational threats by mapping them onto legitimate platform features. While DeepSeek’s model refuses direct ransomware prompts, it generated the necessary HTML/JavaScript code to abuse the File System Access API, accelerating the development of one-off malware. The incident underscores the need for improved permission controls, as current mitigations rely heavily on user vigilance such as avoiding write access to sensitive directories and robust backups. Browser vendors are urged to tighten restrictions, particularly on mobile, where media libraries are prime targets. Defenders must now account for AI-assisted, disposable malware artifacts that complicate detection and attribution.