The LeakNet ransomware operation has adopted a new initial access method using ClickFix social engineering tactics delivered through compromised websites. ClickFix deceives users by presenting fake error messages that prompt them to manually execute malicious commands to resolve non-existent technical issues.
This represents a significant tactical shift for LeakNet, moving away from traditional initial access methods such as stolen credentials. The use of compromised legitimate websites as delivery platforms increases the likelihood of successful victim engagement, as users are more likely to trust content from familiar domains.
The attack chain involves users visiting infected websites where they encounter what appears to be legitimate error messages requiring manual intervention. When victims follow the provided instructions, they unknowingly execute malicious code that establishes the initial foothold for the ransomware deployment.
The campaign also incorporates a Deno in-memory loader, suggesting sophisticated techniques to evade detection and maintain persistence within compromised systems. Organizations should implement robust web filtering, user education programs focused on social engineering awareness, and endpoint detection capabilities to identify suspicious command execution patterns.