LeakNet uses ClickFix via compromised sites to gain access, enabling stealth attacks and scalable ransomware operations.

Interlock ransomware is actively exploiting CVE-2026-20131 (CVSS 10.0) in Cisco FMC, enabling unauthenticated remote code execution as root.