Signal
LeakNet ransomware adopts ClickFix and Deno runtime for stealthy intrusions
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-03-17 12:09 UTCUpdated 2026-03-17 14:34 UTC
rss
ransomwaremalwarethreat_actorsincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
The LeakNet ransomware gang has shifted its initial access strategy by employing the ClickFix social engineering technique via compromised websites.
Entities
LeakNet
Score total
1.03
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- LeakNet’s recent adoption of these techniques signals evolving ransomware strategies in 2026.
- The use of compromised websites for initial access increases risk to organizations relying on web security.
- Early awareness supports timely incident response and security posture adjustments.
Why it matters
- LeakNet’s use of ClickFix represents a novel social engineering tactic that bypasses traditional access methods.
- The Deno-based loader enables stealthy in-memory execution, complicating detection and response.
- Understanding these tactics helps defenders anticipate and mitigate emerging ransomware threats.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- LeakNet ransomware uses ClickFix for initial access via compromised websites
- LeakNet deploys a malware loader based on the open-source Deno runtime for JavaScript and TypeScript
How sources frame it
- BleepingComputer: neutral
- The Hacker News: neutral
All evidence
All evidence
LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
thehackernews · thehackernews.com · 2026-03-17 14:34 UTC
LeakNet ransomware uses ClickFix and Deno runtime for stealthy attacks
BleepingComputer · bleepingcomputer.com · 2026-03-17 12:09 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- thehackernews (1)
- BleepingComputer (1)
Top origin domains (this list)
- thehackernews.com (1)
- bleepingcomputer.com (1)