TL;DR
['LeakNet ransomware utilizes a new method called ClickFix to deploy itself via compromised websites instead of relying on stolen credentials or other common techniques. Users are misled into executing harmful commands manually.', 'A significant shift towards using social engineering and compromised web assets rather t
What happened
['LeakNet ransomware now employs a novel tactic known as ClickFix, delivered via hacked websites to trick victims into running malicious commands. This is distinct from previous approaches such as stolen credentials or malware exploits.', 'Utilizing compromised web assets and the deceptive practice of presenting non-existent errors to entice users to manually execute harmful code represents a significant tactical evolution for LeakNet.']
Why it matters for ops
['This shift towards social engineering techniques like ClickFix poses a new challenge for security operations teams, as it bypasses traditional defensive measures against stolen credentials or malware exploitation.', 'Understanding the nuances of such tactics is crucial for developing effective countermeasures and educating users to avoid falling victim to these sophisticated social engineering attacks.']
Mitigation
- Enhance user education on recognizing and responding to deceptive tactics.
- Implement strict access controls and monitoring for web assets that may be compromised.
Action items
- Review existing security policies related to credential management and social engineering protection.
- Deploy detection mechanisms targeting the ClickFix tactic and Deno in-memory loaders.
Detection IOCs
- Malicious scripts delivered via web pages
- Unexpected Deno in-memory deployments
Source link
https://thehackernews.com/2026/03/leaknet-ransomware-uses-clickfix-via.html