💀 Source Code Honeytoken

Fake creds in code comments and config files.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

Deliberately planted fake credentials, API keys, and connection strings in source code comments, configuration files, and environment templates. These are specifically crafted to be picked up by attacker tools (TruffleHog, GitLeaks, manual grep) and, when used, route to DOAR-controlled infrastructure.

Implementation requirements

Fake credentials that match organizational naming patterns (PHANTOM's "polymorphic" approach)
Placement locations (in order of attacker likelihood to find):
Honey credentials MUST:
Follow the exact format of real credentials (e.g., AWS keys start with AKIA, Stripe keys start with sk_live_)
Route to DOAR-monitored infrastructure when used
Be rotated on a schedule matching real credential rotation
Monitoring: CloudTrail, API Gateway logs, custom webhook on credential use
Rollback: Remove the planted values and revoke the tokens behind them; they remain in version-control history, so treat them as permanently exposed.
Upkeep: Rotate them on the same schedule as real secrets. Monthly proof-of-life use.

Technologies

AWSApplication

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1005 Data from Local System	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — MS Word token: alerts whenever the document is opened in Microsoft Office. Copying it does not fire; opening it does. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1005 to its Lures activity.
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1552.001 Credentials In Files	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.001 Credentials In Files as an adversary behaviour.
T1083 File and Directory Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Windows Directory token: alerts when someone browses the folder in Explorer (via desktop.ini). It does not fire on access that bypasses Explorer. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1083 to its Lures activity.
T1037 Boot or Logon Initialization Scripts	Persistence	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1037 Boot or Logon Initialization Scripts as an adversary behaviour. Reading credentials out of a decoy logon script is logged; the credential fires when used.

Evidence

PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry — Weinberg, A.I., arXiv:2605.02992 2026 peer-reviewed
Canarytokens — Thinkst Applied Research industry
Honeytoken Deployment Strategies — GitGuardian industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
GitGuardian Honeytoken — core concepts — GitGuardian industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Weinberg, "PHANTOM: Polymorphic Honeytoken Adaptation" (ResearchGate, 2026). Thinkst Canarytokens (Industry Standard). GitGuardian Honeytoken Deployment (2024-2026).