Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

This report analyzes an AI-generated sample and subsequent proof-of-concept demonstrating a browser-native ransomware technique that leverages the File System Access API to request folder-level access, enumerate, exfiltrate, and encrypt files (notably photo directories) after social-engineering users to grant permissions; the research emphasizes how LLMs can lower attacker expertise by linking hallucinated malware goals to real browser primitives, shows a working PoC on Android Chromium browsers, and offers practical user-focused mitigations such as treating folder-access prompts as high-stakes decisions, avoiding granting access to sensitive directories, keeping backups, and updating browsers and OSes.