Campaign DetailSource-backed corpus

LeakNet ClickFix / Deno Intrusion Chain

LeakNet delivered ClickFix lures through compromised legitimate websites and used a Deno-based in-memory loader before a repeatable post-access sequence of jli.dll side-loading, PsExec lateral movement, and S3 payload staging.

Last updated Jul 17, 2026, 12:00 PM EDT

Actor Mapping

Mapped Threat Actors

LeakNet

Targeting

Target Sectors / Countries

Cross-industryOpportunistic web users

Tradecraft

ATT&CK / Techniques

T1189T1204.004T1059.007T1218.007T1574.001T1620T1021.002T1102.002

Tools / Observables

Malware, Tools, CVEs

ClickFixmsiexecdeno.exejli.dllUSOSharedPsExecAmazon S3 staging

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

Treat the sequence as observed LeakNet behavior, not a universal playbook or confirmation that every actor claim represents a successful intrusion.

Evidence Controls

Methodology / Claim Status

Reporting period: Research published March 17, 2026
Methodology: Incident-response observations across confirmed LeakNet activity
Sample scope: Multiple investigated intrusions; no universal victim count asserted
Claim status: Observed campaign behavior; successful encryption not assumed

IntelliOS

Related Intel Products

None Found

Citations

Source Trust / Citations

[1] ReliaQuest: Casting a Wider NetReliaQuest Threat Research