Signal
LeakNet ransomware adopts ClickFix and Deno runtime for stealthy attacks
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-03-16 22:56 UTCUpdated 2026-03-17 14:34 UTC
rss
ransomwaremalwaresocial_engineeringinitial_accessincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
The LeakNet ransomware group has shifted to using the ClickFix social engineering technique for initial access, delivered via compromised websites that trick users into running malicious commands. This method replaces traditional credential theft.
Entities
LeakNetClickFixDeno
Score total
1.29
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- Recent reports reveal LeakNet's adoption of ClickFix and Deno, indicating active evolution in ransomware methods.
- A new ClickFix variant leveraging WorkFlowy has emerged, underscoring ongoing threats from social engineering.
- Early awareness enables organizations to adapt defenses against these stealthy malware delivery techniques.
Why it matters
- LeakNet's use of ClickFix shows ransomware groups are innovating social engineering to bypass traditional defenses.
- Deploying malware via the Deno runtime enables stealthy in-memory execution, complicating detection and response.
- Understanding these tactics helps defenders improve phishing awareness and endpoint protection strategies.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- LeakNet ransomware uses ClickFix social engineering technique for initial access via compromised websites.
- LeakNet deploys a malware loader based on the open-source Deno runtime for stealthy in-memory execution.
- A new ClickFix variant uses WorkFlowy and phishing sites mimicking CAPTCHA to deliver malware stealthily.
How sources frame it
- The Hacker News: neutral
- BleepingComputer: neutral
- SC Media: neutral
This briefing highlights LeakNet's shift to social engineering-based initial access and use of modern runtime environments for stealth, signaling evolving ransomware tactics.
All evidence
All evidence
LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
thehackernews · thehackernews.com · 2026-03-17 14:34 UTC
LeakNet ransomware uses ClickFix and Deno runtime for stealthy attacks
BleepingComputer · bleepingcomputer.com · 2026-03-17 12:09 UTC
New ClickFix attack leverages WorkFlowy for stealthy malware delivery
SC Media · scworld.com · 2026-03-16 22:56 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- thehackernews (1)
- BleepingComputer (1)
- SC Media (1)
Top origin domains (this list)
- thehackernews.com (1)
- bleepingcomputer.com (1)
- scworld.com (1)