Planting Canary Tokens and Honey-Files to Identify Your Adversaries

Introduction: Knowing Your Adversary

You’ve already done the heavy lifting. You’ve scrubbed your footprint from data brokers, opted out of the marketing machine, and locked down your digital life with the precision of someone who understands the stakes. But there’s a gap in that armor that standard privacy tools can’t patch: the sophisticated adversary who isn’t casting a wide net, but hunting you specifically.

Let’s be clear about who we’re dealing with. Automated scrapers — the kind that hoover up exposed S3 buckets or crawl public repositories — aren’t typically finding directories that aren’t explicitly listed somewhere. They chase what’s indexed, linked, or advertised. And the average person — an ex, a nosy acquaintance — rarely has the technical chops to probe hidden paths or guess directory names. No, the adversary we’re concerned with here is different. They have skills. They have patience. They’re willing to expend effort to discover what you didn’t mean to make public.

This is where the philosophy of Guerrilla Privacy shifts the battlefield. Instead of remaining purely reactive, we turn the tables. We stop waiting to be breached and start building traps that reveal the breach the moment it happens. By deploying Honey-File Campaigns, we transform our digital spaces into active intelligence zones. We plant decoy documents in locations that require effort to find — not impossible to access, but deliberately unlinked and un-indexed.

The title of this piece, “Planting Canary Tokens and Honey-Files to Identify Your Adversaries,” captures the essence of this approach. But there’s a critical technical distinction worth noting: opening a document and downloading it are two separate events. A canary embedded in a file can fire on preview, on download, or on both—each revealing something different about the adversary’s methods and intent. The Guerrilla philosophy is the perfect solution here because it doesn’t rely on preventing access; it relies on instrumenting access. Every interaction becomes a data point. Every click, a breadcrumb.

They think they’re the hunter. We’re about to change that.

How to Poison Documents: Thinking Like the Adversary

To poison the well effectively, you have to think like the adversary. You need to understand what they value enough to risk accessing a hidden directory—and what they ignore because it doesn’t fit their profile.

What Are They After? (The Bait Categories)

Adversaries generally fall into behavioral archetypes, and their targets reflect that. Your decoys should mimic these high-value categories:

Financial & Legal Leverage — The most common target for corporate espionage or blackmail. Decoy content includes fake tax returns, shell company ledgers, confidential settlement agreements, or lists of offshore accounts. This offers immediate monetary gain or leverage for coercion.

Intellectual Property & Trade Secrets — Targeted by competitors or state actors. Decoy content includes unreleased product road maps, proprietary algorithms, or customer database schemas. This provides competitive advantage or enables industrial sabotage.

Personal Reputation & “Dirt” — Targeted by stalkers, disgruntled associates, or political opponents. Decoy content includes fake medical records, fabricated correspondence, or logs of sensitive communications. Used for character assassination, blackmail, or social engineering.

Credentials & Access Keys — Targeted by opportunistic hackers or credential harvesters. Decoy content includes a file named passwords_master_v2.txt or a JSON config with fake API keys and AWS credentials. Offers immediate access to other systems or monetization on the dark web.

Intentions: Reading the Mind of the Snooper

Understanding why they’re looking helps you tailor the poison:

The Opportunist scans for anything valuable. They grab the first “gold” they see. Your decoy needs to look like low-hanging fruit.

The Hunter has a specific target in mind. They ignore generic files and go straight for the specific filename or keyword they’re after. Your decoy must match their query perfectly.

The Destructive Actor wants to cause chaos. They look for system configs or backup keys to wipe data. Your decoy here should trigger an alert the moment they try to modify it.

The “Last In, First Out” Principle

Adversaries rarely dig deep into the archives immediately.

What They Go After First: The “New,” the “Urgent,” and the “Obvious.” Files dated today, labeled “CONFIDENTIAL,” or named with current project codes. They want the low-hanging fruit.

What They Leave for Last: Old, archived, or seemingly mundane data. They might skip a folder named 2018_Backups or a file named meeting_notes_draft_v1 because it looks like noise.

The Trap: Place your most sophisticated canaries in the “boring” or “archived” folders. If an adversary is thorough enough to dig through archives, they’re likely a high-level threat. If they skip it, they’re likely a low-level opportunist. This distinction helps you gauge threat level.

The Art of the Plausible Lie

The poison must be believable.

Metadata Matters: Use exiftool to set “Created” and “Modified” dates to match the narrative. A “secret” document created yesterday looks suspicious if the author is a deceased relative.

Internal Consistency: If you fake a tax return, the math must add up. If you fake a blueprint, the scale and units must be consistent.

The “Tell”: Embed a subtle, unique identifier that only you would notice if the data leaks. A specific typo, a unique phrase, or a hidden watermark. This proves the source of the leak if it ever surfaces.

Advanced Deception: Multi-Layer Traps

Don’t just plant a file; plant a quest.

The Micro-Dot & Steganography Angle: Use a seemingly innocuous image (like a single dot) that, when enlarged or processed, reveals a hidden message or a second layer of the trap. A file named micro_dot_scan_01.png or blurry_logo.jpg can contain a URL, passphrase, or second decoy file when processed with steganography tools like steghide or zsteg.

The “HQ” Connection: If the second layer requires connecting to a specific, perhaps Tor-hidden, endpoint to “decrypt” or “view” the full content, you capture the IP of the machine attempting that connection. This separates the initial probe from the actual data exfiltration attempt.

The One-Time Pad Distraction: Include a file that looks like a critical OTP key or a reference to one. Maybe a PDF titled OTP_Generation_Manual_v3.pdf or a text file with a long string of random characters labeled key_material.dat. This can link to educational content (like self-made OTP tutorials) that wastes the adversary’s time while appearing valuable.

Triggers: What Fires and When

Not every canary needs to scream. Some whisper. Some don’t speak at all—they just buy you time. The key is matching the trigger type to your threat model and the adversary’s likely sophistication. In a Guerrilla Privacy campaign, the goal isn’t just to catch a breach; it’s to filter noise, waste resources, and gather intelligence on who is probing you.

Workhorse Triggers: DNS and Web Bugs

These are your bread-and-butter. Simple, reliable, and hard to miss without breaking the document itself. They are ideal for the “hidden container” directories you’ve set up, where automated scrapers usually won’t bother looking.

DNS Tokens: When a file containing a unique domain (e.g., abc123.yourdomain.com) is opened, it triggers a DNS lookup. You log the request and capture the timestamp, source IP (or Tor exit node), and query type. This is particularly effective because it fires the moment the file is rendered, even if the user never saves it.

Web Bug / Pixel Tokens: A tiny, invisible 1×1 image embedded in the document that loads from your server when the file is viewed. Whether the file is opened in a browser, an email client, or a document viewer, the image request hits your server. Like DNS tokens, this captures the IP, User-Agent, and timing of the access. Unlike macros, which are often blocked by default in modern Office and LibreOffice suites, web bugs are standard HTML/CSS elements that rarely raise alarms unless the user has strict image-blocking enabled.

Why These Work Best:

• Low Overhead: No complex scripting or macros required.
• Hard to Disable: Disabling them usually breaks the document’s layout or functionality, which an adversary is unlikely to do unless they are highly motivated.
• Fire on Preview: They catch automated scanners and human viewers alike, distinguishing between a quick scan and a deliberate download.
• Easy Rotation: You can swap out the unique domains or image paths frequently to invalidate old caches.

Specialized Triggers: Stego and Document Macros

Sprinkle these in for filtering. They require more effort from the adversary, which means only serious players will engage. This is where you separate the script-kiddies from the dedicated hunters.

Steganographic Layers: A hidden URL or passphrase embedded in an image (like the “micro-dot” concept). The adversary must:

1. Download the file.
2. Run a steganography tool (steghide, zsteg).
3. Extract the hidden data.
4. Connect to the “HQ” endpoint to “unlock” the next layer.

Each step is a new trigger point. If they stop at step 2, you know they’re curious but not committed. If they reach step 4, you have the IP of their analysis machine, potentially separating the downloader from the analyst.

Document Macros: JavaScript or VBA that executes on open. Warning: Modern Office and LibreOffice block macros by default. Use sparingly, and only if you’re targeting adversaries who disable security settings (which itself is a data point indicating high intent). If you do use them, ensure they are paired with a web bug as a fallback trigger in case the macro is blocked.

Non-Alerting Decoys: Pure Misdirection

Not every file needs to phone home. Some exist solely to waste time and contaminate the adversary’s intelligence pipeline.

The OTP Manual: Link to your article on self-made one-time pads: https://pixelateddwarf.com/self-made-one-time-pads-from-everyday-sources/. The adversary spends hours trying to crack a key that doesn’t exist or analyzing a tutorial that leads nowhere. This is a powerful way to waste their time on a dead end while they believe they are making progress.

The Fake Blueprint: A detailed document that looks valuable but contains no actionable intelligence.

The Archive Folder: A directory of “old” files that require digging through. If they skip it, they’re opportunists. If they dig, they’re thorough.

These decoys don’t trigger alerts, but they do consume adversary resources. That’s a win.

Filtering the Noise

Because your directories are hidden (password-protected, non-listed, or unlinked), most automated scrapers will ignore them. They chase what’s indexed, linked, or advertised. This means:

• Fewer False Positives: You won’t be flooded with Googlebot or VirusTotal scans.
• Higher Signal-to-Noise Ratio: When a trigger fires, it’s likely intentional probing.
• Better Attribution: The adversary had to choose to find you. That’s evidence of intent.

Headless Browser Detection

Sophisticated adversaries use headless browsers (Puppeteer, Selenium, Playwright) routed through residential proxies or VPNs to minimize latency and avoid detection. You can spot them by:

• Missing Headers: Accept-Language, Sec-Ch-Ua, or Referer may be absent or generic.
• Unnatural Timing: Instant downloads with no “hover” time suggest automation.
• Static Fingerprints: User-Agent strings that don’t match typical browser behavior.

Log these patterns. Over time, you’ll build a profile of who’s probing you.

Token Rotation and Uniqueness

Keep your campaign fresh:

• Per-File Tokens: Each decoy has a unique identifier. If tax_return_fake.pdf fires but blueprint_fake.pdf doesn’t, you know their interest is financial.
• Time-Based Rotation: Tokens expire and regenerate on a schedule (e.g., weekly). If an old token fires months later, the file was cached or stored.
• Versioning: Track which token version was accessed to detect stale caches.

Operational Security for the Defender

Protect your monitoring infrastructure:

• Don’t Log from Your Real IP: Use a VPS or Tor Hidden Service (.onion) for the listener.
• Don’t Alert from Your Real Email: Use a burner account or Proton alias.
• Encrypt Your Logs: Store them locally with encryption or in Proton Drive.
• Don’t Reveal the Trap: The adversary shouldn’t know they’ve been caught until you choose to act.

A Note on Legalities

While these techniques are powerful, the legal landscape varies by jurisdiction. In some places, logging access to public-but-unlinked directories is a strong legal safeguard; in others, it may be viewed differently. Always consult with a qualified attorney in your jurisdiction to understand the specific legal implications of deploying active monitoring and canary tokens. The goal is to gather evidence, not to create legal liabilities for yourself.

Aftermath: Discovery and Response

The moment a canary fires, the dynamic shifts instantly. You are no longer guessing; you possess concrete data. This section outlines how to interpret that data, decide on a course of action, and leverage the “possession of knowledge” to fundamentally alter your security posture.

Interpreting the Signal: Single Trigger vs. Pattern of Access

Not all alerts are created equal. The context of the trigger tells you more than the trigger itself.

The Single Trigger: A solitary alert from a single file, perhaps a tax_return_fake.pdf accessed once, often indicates a “sweep.” This could be a low-level script scanning for common filenames, a curious automated bot, or a human who stumbled upon the file by accident. While it warrants attention, it doesn’t necessarily imply a targeted, high-intent attack. It’s a “check engine” light, not a crash.

The Pattern of Access: This is where the real intelligence lies. If you see:

• Sequential Access: Multiple decoys accessed in rapid succession (e.g., financials, then contracts, then credentials).
• Persistence: The same IP or User-Agent returning over days or weeks.
• Deep Dives: Access to “archive” folders or steganographic layers that require manual effort.
• Cross-File Correlation: Different decoys triggering from different IPs but with identical behavioral fingerprints (same tooling, same timing patterns).

A pattern indicates intent. It suggests a human operator or a sophisticated script that has moved past random scanning and is actively hunting for specific data. This is the threshold where you shift from “monitoring” to “investigating.”

Reading the Adversary: Intent, Resources, and Sophistication

The data you collect acts as a fingerprint of the adversary’s capabilities.

• Intent: What they accessed tells you what they want. If they only touched the “Financial” decoys, they are likely looking for leverage or money. If they went straight for the “Credentials” or “System Config” files, they are looking for access to your infrastructure.
• Resources: The speed and volume of access indicate their toolkit. Instant, high-volume downloads suggest a botnet or a large-scale scraper. Slow, deliberate access with pauses suggests a human analyst or a carefully tuned script.
• Sophistication: Did they bypass the “micro-dot” stego layer? Did they try to connect to the “HQ” endpoint? Did they use a residential proxy or a known Tor exit node? If they navigated your multi-layer traps, they are likely a professional or a state-affiliated actor. If they stopped at the first hurdle, they are likely an opportunist.

The Decision Framework: Silence, Documentation, or Escalation

Once you have the data, you must choose your response. There is no one-size-fits-all answer; it depends on your threat model and the nature of the adversary.

1. Silence and Observation (The “Shadow” Approach)

• When to use: Early stages, single triggers, or when the adversary is low-sophistication.
• Strategy: Do nothing. Let them think they are successful. Continue to feed them more decoys.
• Goal: Gather more intelligence. The longer they stay in your “playground,” the more data you collect about their methods, tools, and potential partners. Sometimes, the best move is to let them waste months on fake data.

2. Legal Documentation (The “Paper Trail” Approach)

• When to use: Clear evidence of unauthorized access, especially if the adversary is a known entity (e.g., a former employee, a competitor) or if the access involves sensitive personal data.
• Strategy: Secure your logs immediately. Ensure the chain of custody is intact (timestamped, hashed, stored in encrypted, immutable storage like Proton Drive or a write-once medium). Consult with legal counsel to determine if the evidence meets the threshold for a CFAA (or local equivalent) claim.
• Goal: Create a defensible record for potential litigation or law enforcement involvement. The goal is to establish that the access was unauthorized and intentional.

3. Escalation (The “Active Defense” Approach)

• When to use: High-sophistication threats, repeated access, or evidence of active exfiltration attempts.
• Strategy: This is the most aggressive path. It could involve:
  • Direct Confrontation: Sending a cease-and-desist letter (risky, as it reveals you know).
  • Law Enforcement: Reporting the incident with your evidence package.
  • Counter-Measures: Deploying additional, more aggressive traps (e.g., “poisoned” data that actively degrades their analysis tools, though this carries legal risks and should be done with extreme caution).
• Goal: Disrupt the adversary’s operations, force them to abandon the target, or bring legal consequences.

When to Move Real Data vs. Hold Position

The trigger is a warning bell, but it doesn’t always mean you need to evacuate.

• Move Immediately If: The adversary has accessed a decoy that is too close to your real data (e.g., a decoy in the same directory structure as your real secrets), or if the pattern suggests they have already mapped your entire infrastructure.
• Hold Position If: The decoy is isolated, and the adversary is still in the “reconnaissance” phase. Moving real data can sometimes alert the adversary that you know they are there, causing them to switch tactics or go deeper underground. Sometimes, it’s better to let them believe they have found a goldmine while you quietly move the real treasure to a new, unlinked location.

The “Silent Migration” Strategy: If you decide to move data, do it silently. Don’t change the decoy. Keep the trap active. Migrate your real data to a new, hidden container with a new set of decoys. This allows you to continue monitoring the original adversary while securing your assets.

Documentation Standards for Potential Legal Use

If you ever end up in court, the quality of your evidence matters. “I saw a log” is not enough.

• Chain of Custody: Document who collected the log, when, and how. Use cryptographic hashing (SHA-256) to prove the logs haven’t been tampered with since collection.
• Timestamp Synchronization: Ensure your server clocks are synchronized to an NTP server. Discrepancies in time can be exploited by defense attorneys.
• Contextual Metadata: Don’t just log the IP. Log the User-Agent, the specific file path, the HTTP method, and the referrer.
• Immutable Storage: Store logs in a write-once, read-many (WORM) format or use a service like Proton Drive with versioning and encryption enabled.
• Correlation: Link the trigger event to the specific decoy file and its unique identifier. Show the timeline of the attack.

The “Possession of Knowledge” Advantage

Ultimately, the greatest victory of a Honey-File Campaign isn’t catching the thief; it’s the awareness it brings.

Before the trigger, you were operating in the dark, assuming you were safe or vulnerable without proof. After the trigger, you have certainty.

• You know you are being watched.
• You know how they are watching.
• You know what they are looking for.
• You know who (or at least what kind of actor) is behind it.

This knowledge changes everything. It allows you to:

• Stop guessing: You no longer need to wonder if you’re safe.
• Prioritize defenses: You can focus your resources on the specific vectors they are exploiting.
• Psychologically dominate: You know they are walking through a maze of your design. They are the ones who are anxious, wondering if they’ve been caught. You are the one holding the map.

In Guerrilla Privacy, the goal isn’t just to survive the attack; it’s to emerge with the upper hand, armed with intelligence that turns the adversary’s aggression into your strategic advantage.

Wrap-Up: From Hiding to Knowing

We started this journey by acknowledging a gap in even the most hardened privacy defenses: the silent, targeted snoop. You can scrub your data from brokers and lock down your accounts, but if an adversary with the right skills and patience decides to probe your hidden directories, standard tools leave you in the dark. You know you might be watched, but you don’t know who, when, or how.

By deploying Honey-File Campaigns, you have closed that gap. You’ve moved from a passive state of defense to an active posture of intelligence. Here is the code to run it.