canarytokens

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Drive-by data exfiltration using open WiFi networks & DNS requests

Detects CanaryTokens in Office docs and PDFs (docx, xlsx, pptx, pdf) without triggering alerts

Context bomb strings

A Red Team Script to Detect Canary Tokens and Seed Files

Cloud Canary Object Orchestration Management Platform

eBPF Canarytoken trigger

HTTP honeypot on autopilot

Bring CanaryTokens Into Sentinel

Weaponize .xlsx files with hidden tracking pixels and NTLMv2 hash-capture payloads via HTTP, SMB, or WebDAV — no macros, zero dependencies, pure Python.

Linux Phisical Security based on eBPF

Local-first honeypot toolkit for Linux. Drop convincing decoy credentials across your filesystem — AWS keys, SSH keypairs, .env files and more — and get sub-second forensic alerts the instant anything touches them. Zero telemetry. GPL-3.0.

Ansible role to deploy canarytokens with Docker

open source serverless tripwires for detecting unwanted access.

Low regret ClickFix mitigation script for Windows

Self-hosted DNS + HTTPS canary in a single Go binary — mint a link, see exactly who resolves and fetches it, live.

USB drop penetration testing platform with CanaryTokens integration, real-time alerting, campaign management, and AI-generated lure content.

An HTTP honeypot built to measure exploitation rather than discovery: attributable honeytokens, a shared detector table, and a reproducible offline analyzer.

Self-hosted deception platform — canarytokens and endpoint honeypots you run yourself

Automation playbooks created for use with Tines Cloud SOAR