Beyond Traditional Malware: The Emerging Risk of In-Browser Ransomware

Beyond Traditional Malware: The Emerging Risk of In-Browser Ransomware 

Introduction 

Web browsers have become more than tools for accessing websites. They now support document editing, file management, image processing, cloud collaboration, and increasingly sophisticated AI-powered applications. As these capabilities expand, the boundary between a website and a traditional desktop application becomes less distinct. 

This evolution offers convenience, but it also introduces security challenges that deserve greater attention. 

Consider a scenario in which an employee visits an online tool to enhance photographs or convert documents. The service requests access to a local folder, and the employee grants permission because it appears necessary for the task. Instead of processing the intended files, however, the website abuses that access to manipulate other files within the authorised location. 

This scenario illustrates the concept of in-browser ransomware: a technique that can potentially encrypt or overwrite user-selected files through a web application without requiring a conventional ransomware executable to be installed. 

In July 2026, Check Point Research highlighted this risk through an investigation into AI-generated malicious code. The researchers found that a largely flawed malware concept contained a technically significant idea: abusing legitimate browser file-access functionality to create a practical ransomware workflow. 

The significance of this research extends beyond a single attack demonstration. It raises questions about browser permissions, the security of web applications, and the ability of artificial intelligence to connect existing technologies in unexpected ways. 

1. Rethinking the Traditional Ransomware Model 

Ransomware is commonly associated with malicious software that executes on a victim's device, encrypts files, and demands payment for their recovery. Incidents often involve compromised credentials, malicious attachments, vulnerable systems, or unauthorised software execution. 

In-browser ransomware introduces a different approach. 

Instead of relying on a separately installed malicious program, an attacker can attempt to perform destructive file operations through a malicious web application that has been granted the necessary access by the user. 

This does not mean that the browser has been completely compromised or that its security protections have been bypassed. The technique can operate through legitimate browser functionality, subject to the relevant permissions, implementation, and security restrictions. 

The distinction matters because many security controls are designed to detect suspicious executables, unusual process activity, or known malware signatures. A browser-based attack may follow a different path, making it important for defenders to consider how trusted applications can be misused. 

The browser itself is not the threat. The risk comes from the combination of malicious intent, user-authorised access, and the ability to modify local data. 

2. The Browser Feature Behind the Risk 

A key technology involved in this attack is the File System Access API, which enables supported web applications to interact with files and directories selected by users. 

The API has legitimate applications. A browser-based editor may need to open an existing document, while an image-processing tool may need to save changes directly to a selected file. These capabilities allow websites to provide functionality that was once largely associated with installed desktop software. 

However, the same capabilities can create an opportunity for abuse. 

When a user grants access to a directory, a web application may be able to interact with files within that authorised location, depending on the permissions granted and the browser's implementation. If the application is malicious, it may attempt to use this access for purposes unrelated to its advertised function. 

For example, a website presented as an image-enhancement service may request access to a folder of photographs. If the user grants that access, the application could potentially attempt to manipulate accessible files rather than simply enhance the intended images. 

This is a problem of trust and permission management rather than proof that the browser is inherently insecure. 

The key security question is not simply whether an application can access a file, but whether the access it receives is appropriate for the task it claims to perform. 

3. From a Seemingly Harmless Website to File Destruction 

In-browser ransomware can be understood as a sequence of events involving deception and the misuse of authorised functionality. 

Establishing credibility 

An attacker presents a web application that appears useful and legitimate. AI-powered photo editors, file converters, document tools, and other online utilities could provide convincing pretexts for requesting file access. 

Obtaining file permissions 

The website asks the user to select a file or directory. Because the request appears consistent with the advertised service, the user may not fully consider the potential consequences. 

Misusing the granted access 

Once access is obtained, malicious code may attempt to read, transmit, encrypt, or overwrite accessible files. The extent of the potential damage depends on the browser's capabilities, the scope of the granted permission, and the application's implementation. 

Disrupting access to data 

If destructive operations succeed, files may become inaccessible or unusable. The attacker could then display a ransom demand, imitating the outcome associated with conventional ransomware. 

Unlike many traditional infections, this scenario does not necessarily require a separate executable download or application installation. However, it is not an automatic consequence of visiting a website: the necessary access must be available, and the malicious application must successfully carry out the intended operations. 

This distinction is important when assessing the actual risk rather than assuming that every website with file-access functionality is dangerous. 

4. The Role of AI in Developing Browser-Based Attacks 

Browser-based ransomware was not an entirely new concept in 2026. Earlier academic research had already demonstrated that modern browser technologies could be abused to encrypt local files. 

The more recent investigation by Check Point Research highlighted a different development: the role of AI-generated code in connecting an existing technical capability to a practical attack scenario 

During its analysis of files attributed to DeepSeek, the research team identified a malicious sample that attempted to combine numerous capabilities into a single browser-based application. Much of the code was technically flawed, but its use of browser file-access functionality revealed a viable direction for further investigation. 

The researchers investigated how the underlying concept could be translated into a working proof of concept. This finding demonstrates why AI-generated malware should not be evaluated solely on whether the entire output functions correctly. Even a largely unsuccessful program may contain a useful technique that can be refined or combined with other components to produce a functional attack. 

The broader concern is that AI systems may help connect existing technologies and programming techniques, making certain attack methods easier to explore and develop. However, AI-generated code is not inherently reliable or effective. Its potential security impact lies partly in the ability to identify useful components within flawed outputs and adapt them for malicious purposes. For cybersecurity professionals, this highlights a broader challenge: AI-assisted threats are not limited to conventional malware generation. AI may also help attackers identify and combine legitimate platform capabilities in ways that create new opportunities for abuse. This reinforces the need for security controls that consider not only known vulnerabilities but also how legitimate technologies can be misused. 

5. Why Mobile Devices Are an Important Consideration 

Mobile devices are increasingly used for work, financial transactions, document storage, and personal information management. Their file collections may contain photographs, identity documents, screenshots, travel records, and confidential business information. 

This makes browser-based file access particularly relevant to mobile security. A malicious website may appear to offer a useful service that naturally requires access to photographs or other files. The user may therefore perceive the permission request as a normal part of the experience rather than a security decision. 

Check Point Research demonstrated its proof of concept in Android and Windows environments, highlighting the relevance of browser-supported file-access capabilities in those settings. 

The findings should not be generalised to every mobile device or browser. Support for the relevant interfaces and the scope of accessible files vary according to browser implementation, operating system, and permissions. 

Nevertheless, the research reinforces an important point: mobile security assessments should consider browser-based applications alongside installed applications. Organisations that permit employees to use personal devices for business activities should also consider whether browser permissions could expose locally stored corporate information. 

6. Why Conventional Security Controls May Need to Adapt 

In-browser ransomware presents a challenge because malicious activity may occur through functionality that has legitimate business uses. 

An organisation cannot simply prohibit every application that accesses files. Document editors, collaboration platforms, and creative tools depend on these capabilities. The challenge is identifying when legitimate functionality is being used in an unsafe or malicious way. 

Several implications deserve attention: 

Executable-focused detection may not be sufficient on its own. Security teams should also consider suspicious browser activity and unauthorised or unexpected file modifications. 

User approval is not equivalent to a security assessment. A permission prompt may be legitimate, but users can still be misled about why access is required or how it will be used. 

Browser activity belongs within the organisational threat model. Browser security should be considered alongside endpoint protection, identity security, application control, and data protection. 

AI-assisted development may increase the variety of attack implementations. Defenders should avoid relying exclusively on recognition of previously known malicious code. 

These points do not make traditional endpoint security ineffective. They highlight the importance of layered controls that address the behaviour of applications and the data they access, rather than depending on a single detection method. 

7. Defensive Measures for Individuals and Organisations 

Reducing the risk of in-browser ransomware requires both user awareness and technical controls. 

Apply the principle of least privilege 

Users should grant websites access only to the files or directories necessary for the intended task. Where practical, selecting an individual file is preferable to granting access to a broad directory containing sensitive information. 

Review browser security policies 

Organisations should assess the browsers used in their environments, keep them updated, and review available controls for restricting unnecessary file-system access. Security teams should verify which controls are supported rather than assume that every browser exposes the same configuration options. 

Improve endpoint and file-activity monitoring 

Security monitoring should consider unusual patterns of file modification and suspicious browser-related activity. Organisations should assess whether their endpoint protection and monitoring tools provide adequate visibility into browser-initiated operations. 

Protect sensitive information 

Data-loss prevention measures, access controls, and appropriate data-handling policies can help limit the exposure of confidential information. Employees should avoid granting unfamiliar web applications access to directories containing sensitive corporate documents. 

Maintain resilient backups 

Important data should be backed up regularly to appropriately protected locations. Backups should be separated from routine user access where feasible, and restoration procedures should be tested. A backup strategy should account for the possibility that synchronised or connected storage could also be affected by destructive file operations. 

Expand security awareness training 

Awareness programmes should explain that security risks are not limited to email attachments and downloaded applications. Employees should be taught to assess website permissions, verify the legitimacy of online services, and question requests for access that seem excessive for the task. 

Include browser risks in incident response planning 

Incident response procedures should address suspicious browser activity, potential file destruction, permission revocation, evidence preservation, and recovery from trusted backups. Organisations should also determine how to identify the scope of affected files and whether sensitive information may have been exposed. 

8. Implications for Information Security and GRC 

For information security and governance, risk, and compliance professionals, this technique provides a useful example of why technology risk assessments must evolve alongside changes in application functionality. 

Traditional assessments may focus on installed software, network access, vulnerabilities, and endpoint threats. However, browser-based applications can now perform activities that interact directly with local files, making browser permissions relevant to data protection and operational resilience. 

Organisations should consider the following questions during risk assessments and security reviews: 

• Are employees permitted to grant websites access to local business files? 

• Are browser security settings centrally managed where appropriate? 

• Can endpoint security tools identify suspicious file modifications initiated through browser activity? 

• Are sensitive files stored in locations that unnecessary browser permissions could expose? 

• Are backup and restoration arrangements sufficient to recover from destructive file operations? 

• Does security awareness training cover permission-based threats, including deceptive AI-powered services? 

These questions can be incorporated into existing information security risk assessments, endpoint security reviews, data protection controls, and incident response exercises. 

The research also highlights the importance of evaluating new technologies based on their actual capabilities and potential misuse, rather than assuming that browser-based applications are inherently safer because they do not require installation. 

It is equally important to maintain a proportionate view of the threat. The 2026 investigation demonstrated a practical proof of concept, but Check Point Research reported that it had not observed this exact technique being exploited in real-world campaigns at the time of publication. Its value lies in exposing a credible attack path that security teams can assess before it becomes a more established threat. 

Conclusion 

In-browser ransomware challenges a familiar assumption in cybersecurity: that destructive malware must first be installed or executed as a conventional program. 

By abusing legitimate browser file-access capabilities, a malicious web application may be able to create a ransomware-like impact without following the traditional infection model. The involvement of AI-generated code adds another dimension, demonstrating how existing technologies can be combined into a practical attack scenario even when the original code is largely flawed. 

For organisations, the response should not be to avoid browser-based applications altogether. Instead, it should be to understand the permissions those applications require, limit unnecessary access, strengthen monitoring, and maintain reliable recovery mechanisms. 

As browsers continue to evolve into increasingly capable application platforms, their security must be assessed not only in terms of vulnerabilities but also in terms of how legitimate functionality can be abused. 

Ultimately, the lesson is clear: the absence of an installed malicious program does not necessarily mean that local data is safe. Browser permissions, like any other form of access, must be granted carefully and managed as part of a broader security strategy. 

References 

1. Bukhteyev, A. (2026). Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique. Check Point Research. 
   https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/ 

1. Oz, H., Aris, A., Acar, A., Tuncay, G. S., Babun, L., & Uluagac, S. (2023). RøB: Ransomware over Modern Web Browsers. Proceedings of the 32nd USENIX Security Symposium, 7073–7090. 
   https://www.usenix.org/conference/usenixsecurity23/presentation/oz 

1. Oz, H., Tuncay, G. S., Aris, A., Babun, L., Uluagac, S., & Acar, A. (2025). Ransomware over Modern Web Browsers: A Novel Strain and A New Defense Mechanism. https://doi.org/10.1145/3708514