🧬 Polymorphic Honeytoken Generator

LLM-powered factory generating org-mimicking fake credentials.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

An automated system that uses LLMs to generate honeytokens that are **statistically indistinguishable** from real organizational credentials. Instead of hand-crafting fake AWS keys, the PHANTOM approach analyzes the organization's real credential patterns (naming conventions, key formats, rotation schedules) and generates honeytokens that match perfectly — defeating automated honeytoken detection tools that sophisticated attackers use.

Implementation requirements

LLM with access to organizational naming patterns (NOT actual secrets — just format/structure)
Template engine for each credential type: AWS IAM keys, Azure SAS tokens, GCP service account JSON, database connection strings, OAuth tokens
Rotation automation: Honeytokens must rotate on the same schedule as real credentials
Distribution pipeline: Automatically seed new honeytokens across code repos, CI/CD, endpoints, and cloud environments
Validation: Each generated honeytoken must pass format checks that real scanners (TruffleHog, GitLeaks) would apply
This is essentially the DOAR equivalent of a "honeytoken factory"
Rollback: Revoke every generated token and stop the generator.
Upkeep: Regenerate when real credential formats change. Review the generator's output for any real data.

Technologies

AI/LLMAWSAzureCI/CDGCP

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1552 Unsecured Credentials	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted in public GitHub repositories were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in nine kinds of cloud resource were found and used; GitHub keys within 2 minutes, S3 within 8 hours. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1552 to its Lures activity.
T1552.002 Credentials in Registry	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Detection of Breach Campaigns by using Distributed Deception — A production deception platform plants honey authentication values in the Windows registry. 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.002 Credentials in Registry as an adversary behaviour.
T1552.004 Private Keys	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.004 Private Keys as an adversary behaviour. A decoy private key fires when used to log in to a honeypot; no source covers decoy keys specifically.

Evidence

PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry — Weinberg, A.I., arXiv:2605.02992 2026 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Weinberg, "PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry" (ResearchGate, 2026).