FulcrumSec

Tactics, Techniques & Procedures (TTPs)

• GitHub PAT (Personal Access Token) scanning in deployed JavaScript bundles — publicly accessible web applications routinely expose PATs in bundled frontend code
• Private repository cloning using discovered PATs to access source code, CI/CD config, and credential stores
• Credential harvesting from private repos: API keys, cloud credentials, database connection strings, service account tokens
• Cloud data exfiltration using the victim's own credentials — attacker operates via victim infrastructure, not external staging
• Pure extortion model: threat of data publication without any encryption-based leverage
• High-value target selection: companies with exposed PATs typically have significant development infrastructure and proprietary IP

Known Targets

Analyst Notes

FulcrumSec emerged October 2025 as a pure data extortion group with no ransomware component. The GitHub PAT scanning technique exploits the widespread practice of hardcoding credential material in deployed frontend JavaScript. A valid PAT with repository scope enables private repo cloning and credential harvest; cloud credentials in committed files or environment variable files then enable direct cloud data theft through the victim's own infrastructure. The technique spreads as developer credential sprawl in deployed applications remains structurally underaddressed — it requires no vulnerability exploitation, only automation.

MITRE ATT&CK Techniques