In a technical report from ReliaQuest, the company said LeakNet is using ClickFix delivered through compromised websites for initial access and a staged Deno JavaScript loader that executes payloads in memory.
KEY FACTS
- Initial access ClickFix fake CAPTCHA pages served from compromised sites
- Loader Deno runtime executes Base64 JavaScript directly in memory
- Post-compromise DLL side-loading, PsExec lateral movement, data exfiltration to S3
- First seen LeakNet emerged in November 2024
ClickFix pages instruct users to paste a command that runs msiexec.exe in the Windows Run dialog to deliver the initial loader. The technique uses legitimate but compromised websites and fake verification workflows to trick users into running routine commands.
The staged loader is built on the Deno JavaScript runtime and runs Base64-encoded scripts directly in memory. The payload fingerprints the host, contacts an external server to fetch next-stage malware and enters a polling loop to fetch and execute additional code.
After execution, the chain uses DLL side-loading to load a malicious library, then moves laterally with PsExec. Operators run cmd.exe /c klist to enumerate reachable credentials. Staging and exfiltration use S3 buckets to blend with normal cloud traffic.
ReliaQuest also observed a separate intrusion that used Microsoft Teams-based phishing and ended in a similar Deno-based loader. The approach reduces on-disk evidence and lowers per-victim acquisition cost compared with relying on stolen credentials from brokers.
WHY IT MATTERS
The shift to ClickFix and a bring-your-own-runtime loader can increase attack scale while leaving fewer network signals. The repeatable post-exploitation sequence offers defenders discrete behaviors to detect before ransomware is deployed.