What happened
Recent reporting says the LeakNet ransomware operation is using ClickFix lures to trick users into launching attacker commands, then dropping a loader built on the legitimate Deno runtime.
Researchers say this loader executes a base64 payload primarily in memory, reducing obvious disk artifacts and making detection harder when environments rely on basic file-based controls.
Why this matters
This is a practical blend of:
- Social engineering (convincing someone to run commands)
- Living-off-trusted-tools behavior (abusing signed, legitimate runtime software)
- Ransomware tradecraft that can accelerate lateral movement
For defenders, this raises risk in organizations where user-driven scripting workflows are common.
What defenders should do now
- Harden against ClickFix-style prompts (user training + browser protections + endpoint controls).
- Alert on Deno execution outside approved developer paths.
- Restrict PowerShell/VBS abuse paths and monitor suspicious script chains.
- Limit PsExec/admin remote tooling to approved operators only.
- Track unusual outbound traffic and staged payload behavior after script execution.
How to check if you’re affected
Affected scope: organizations or users potentially exposed to LeakNet ransomware uses ClickFix and Deno runtime for stealthier intrusions conditions should validate immediately.
Quick verification steps:
- Confirm your exposure surface
- Identify whether your environment uses the affected product/service/version mentioned in this advisory.
- Check official advisories and indicators
- Compare your deployed versions/configuration against vendor or authority guidance.
- Review logs for suspicious activity
- Investigate authentication, admin, process, and network anomalies tied to this threat pattern.
- Validate mitigations are active
- Apply patches/workarounds and re-check for failed exploit attempts or recurring indicators.
Sources
- https://www.bleepingcomputer.com/news/security/leaknet-ransomware-uses-clickfix-and-deno-runtime-for-stealthy-attacks/
- https://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threat/
Bottom line
LeakNet’s ClickFix + Deno approach shows how attackers can combine human deception with legitimate runtime tooling to stay quieter longer. Treat this as an immediate detection-engineering and hardening priority.