India, July 3 -- A random web page should not feel as risky as installing a shady app. That is what makes this browser-only ransomware technique so uncomfortable. It can use Chrome's own File System Access API to reach Android photo folders after the user grants permission.

No app install. No root access. No classic malware drop. Just one browser prompt that looks normal in the moment.

Security researchers found the idea inside an AI-generated malware sample linked to DeepSeek. The sample, called InfernoGrabber v9.0, dressed itself up as a Discord-style AI avatar upscaler. Most of the code was messy and overpromised what a browser can actually do. But one part was not just noise. It used real browser file access methods to request a fol...