Check Point Demonstrates LLM-Generated Browser-Native Ransomware

Chromium-based browsers (Chrome, Edge) on Windows, macOS, Linux, ChromeOS, and Android; proof-of-concept technique generated by prompting DeepSeek

A fake image-enhancement page uses the browser File System Access API (`showDirectoryPicker`) to read, exfiltrate, and encrypt a victim's local files with no native payload, app install, browser exploit, or root access. iOS and Safari are unaffected because the API is not exposed there

A large language model connected an unrealistic "browser malware" idea to a legitimate, sanctioned browser permission API, producing a practical social-engineering abuse path rather than exploiting a browser vulnerability