20260317-thehackernews.com-09bcd | Perceptive Security

< Back to index

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

Published:

17 March 2026 at 14:34:00

Alert date:

17 March 2026 at 16:02:36

Source:

thehackernews.com

Ransomware & Malware, Web Technologies, Data Breach & Exfiltration

LeakNet ransomware operation has adopted ClickFix social engineering tactics delivered through compromised websites as an initial access method. This represents a shift from traditional initial access methods like stolen credentials. The attack involves tricking users into manually running malicious commands to address fake errors. The campaign deploys a Deno in-memory loader for payload execution. This technique leverages user interaction and compromised websites to establish initial foothold in target environments.

Technical details

LeakNet ransomware uses ClickFix social engineering delivered through compromised websites to trick users into running malicious msiexec.exe commands via fake CAPTCHA verification checks. The attack employs a staged command-and-control loader built on the Deno JavaScript runtime to execute Base64-encoded JavaScript payloads directly in memory to evade detection. The loader fingerprints the system, contacts external servers for next-stage malware, and enters a polling loop for additional code execution. Post-compromise activities include DLL side-loading, lateral movement using PsExec, data exfiltration via S3 buckets, and encryption. The group uses cmd.exe /c klist to enumerate active authentication credentials for faster lateral movement.

Mitigation steps:

Monitor for known behaviors at each stage of the attack chain to detect and disrupt operations before ransomware deployment. Implement detection for ClickFix social engineering attempts, monitor for suspicious msiexec.exe execution, watch for Deno runtime processes, detect DLL side-loading activities, monitor PsExec usage for lateral movement, and watch for unusual S3 bucket traffic patterns for data exfiltration.

Affected products:

Windows operating systems
Deno JavaScript runtime
Microsoft Teams
VPN solutions
Firewall systems
S3 cloud storage buckets

Related CVE's:

Related threat actors:

IOC's:

msiexec.exe commands distributed via fake CAPTCHA checks, Base64-encoded JavaScript payloads, Deno runtime processes executing in-memory payloads, DLL side-loading activities, PsExec lateral movement, cmd.exe /c klist credential enumeration, S3 bucket exfiltration traffic

This article was created with the assistance of AI technology by Perceptive.