Back Cybersecuritynews

LeakNet Scales Ransomware Operations With ClickFix Lures and Stealthy Deno Loader

Cybersecuritynews •Tushar Subhra Dutta • March 18, 2026

A ransomware group known as LeakNet has been quietly building a more dangerous attack strategy. Until recently, the group averaged three victims per month — but new evidence shows it is scaling up fast, adding new tools that most security defenses are not built to catch. LeakNet has introduced two notable additions: a social […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LeakNet Ransomware Expands Tactics with ClickFix and Deno Loader LeakNet, a ransomware group, has adopted new tactics involving ClickFix social engineering and a Deno-based fileless loader. This shift allows them to gain initial access through compromised websites, prompting users to execute malicious commands disguised as error fixes. The group has been active since late 2024 and typically averages three victims per month, but recent changes indicate a scaling up of operations. The ClickFix technique has been linked to 59% of top malware families in 2025, complicating detection efforts for defenders. The Deno loader executes malicious payloads in memory, leaving minimal forensic traces. This method utilizes legitimate developer tools to evade security measures, making it harder for organizations to detect and respond to the attacks. ReliaQuest has high confidence in linking these activities to LeakNet based on consistent infrastructure and tactics observed in recent incidents. 7 sources 70

Extracted Entities

LeakNet Scales Ransomware Operations With ClickFix Lures and Stealthy Deno Loader

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Ransomware Groups (1)