LeakNet Ransomware Spreads via ClickFix Through Hacked Websites
Cybersecurity researchers have uncovered that LeakNet ransomware is utilizing hacked websites and a tool called ClickFix for its propagation. This novel method allows the ransomware to deploy in memory, making it harder to detect.
LeakNet Ransomware Spreads Using ClickFix via Hacked Sites
A new development in the cybersecurity landscape highlights the innovative propagation methods of the LeakNet ransomware. Researchers have identified that this ransomware leverages compromised websites and a stealthy tool known as ClickFix to spread its reach. This technique allows for in-memory deployment, significantly complicating detection efforts.
ClickFix and In-Memory Loader Usage
A distinctive feature of LeakNet is its use of a Deno-based in-memory loader. This loader enables the malicious payload to be injected directly into the system's memory without writing to disk. Such a tactic is highly effective in evading traditional antivirus solutions, thereby enhancing the ransomware's stealth capabilities.
Role of Compromised Websites
Hacked websites play a crucial role in the ransomware's distribution. Attackers exploit these sites to trick users into downloading or executing a malicious script that ultimately deploys ClickFix. Once users are exposed to these scripts, LeakNet's in-memory loader becomes active, infiltrating the system.
Has your email been leaked? Check for free — results in seconds.
Check Now →Cybersecurity Implications
This new attack vector presents significant challenges for cybersecurity professionals. The inadequacy of traditional signature-based detection methods underscores the importance of advanced behavioral analysis and network monitoring techniques. It is paramount for organizations and individuals to remain vigilant against scripts from untrusted sources and maintain up-to-date security measures.
Recommended Security Measures
- Be cautious of scripts downloaded or executed from untrusted websites.
- Keep your antivirus and security software updated.
- Perform regular system backups.
- Consider advanced threat detection solutions.
Conclusion
The propagation of LeakNet ransomware using ClickFix and a Deno-based in-memory loader signifies the evolution of cyber threats. This advancement necessitates the adaptation of our defense strategies to counter such sophisticated techniques.
Source
https://thehackernews.com/2026/03/leaknet-ransomware-uses-clickfix-via.html