LeakNet boosts ransomware with ClickFix lures, stealthy Deno loader

LeakNet is scaling its ransomware operation by delivering ClickFix social-engineering lures on compromised legitimate websites that trick users into running msiexec commands, then deploying a stealthy Deno-based in-memory loader and follow-on post-exploitation techniques (DLL sideloading, PsExec, Kerberos enumeration, and S3-based staging/exfiltration). The report highlights consistent TTPs across incidents, detection opportunities (unusual msiexec from browsers/Win-R, Deno running base64 data URLs, java.exe loading jli.dll), and provides a list of associated malicious domains, IPs, and S3 buckets.