LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

LeakNet ransomware group has adopted ClickFix social engineering via compromised websites and a Deno-based in-memory loader as new attack vectors.

• •ClickFix tricks users into manually running msiexec.exe commands via fake CAPTCHA pages on legitimate but compromised websites
• •A Deno JavaScript runtime loader executes Base64-encoded payloads directly in memory to minimize on-disk evidence and evade detection
• •Post-compromise sequence includes DLL side-loading, lateral movement via PsExec, data exfiltration to S3 buckets, and encryption
• •LeakNet uses cmd.exe /c klist to enumerate active credentials and moves laterally without requesting new ones
• •Microsoft Teams-based phishing was also observed leading to a similar Deno-based loader, possibly indicating broader BYOR technique adoption