Back Gbhackers

LeakNet boosts ransomware with ClickFix lures, stealthy Deno loader

Gbhackers •Mayura Kathir • March 18, 2026

LeakNet is scaling its ransomware operation by pairing mass-market ClickFix lures with a stealthy Deno-based loader that executes almost entirely in memory, shrinking the window for defenders to intervene. Ransomware operator LeakNet is currently averaging around three victims per month. However, recent activity shows the group investing in its own delivery and execution infrastructure to grow that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LeakNet Ransomware Expands Tactics with ClickFix and Deno Loader LeakNet, a ransomware group, has adopted new tactics involving ClickFix social engineering and a Deno-based fileless loader. This shift allows them to gain initial access through compromised websites, prompting users to execute malicious commands disguised as error fixes. The group has been active since late 2024 and typically averages three victims per month, but recent changes indicate a scaling up of operations. The ClickFix technique has been linked to 59% of top malware families in 2025, complicating detection efforts for defenders. The Deno loader executes malicious payloads in memory, leaving minimal forensic traces. This method utilizes legitimate developer tools to evade security measures, making it harder for organizations to detect and respond to the attacks. ReliaQuest has high confidence in linking these activities to LeakNet based on consistent infrastructure and tactics observed in recent incidents. 7 sources 70

Extracted Entities

LeakNet boosts ransomware with ClickFix lures, stealthy Deno loader

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (1)

Tools (1)