LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

The LeakNet ransomware operation has adopted a novel social engineering technique, dubbed ClickFix, to gain initial system access, representing a significant shift from conventional methods like exploiting stolen credentials. This tactic involves luring victims, typically through compromised websites, into manually executing malicious commands disguised as fixes for fabricated system errors. Upon successful user deception, the attackers then deploy a Deno-based in-memory loader, facilitating the subsequent delivery and execution of the LeakNet ransomware payload. This approach leverages active user interaction and perceived legitimacy, effectively circumventing some traditional security controls designed to detect automated exploits or credential misuse. The adoption of ClickFix, first reported on March 17, 2026, highlights a strategic pivot by threat actors to exploit human vulnerabilities and integrate less common execution frameworks, such as Deno, to maintain stealth and persistence within target environments¹. This evolution in initial access methods demands heightened vigilance. Practitioners must prioritize comprehensive user awareness training and robust endpoint detection capabilities to counter such sophisticated, user-centric attack chains.