0x4D31/stinger

HoneyWire: The Open-Source, Unlimited Deception Platform. Turn any Linux machine into an enterprise-grade canary in 60 seconds.

Modular and decentralised honeypot

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the moment an attacker opens one.

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

Sandfly Security Agentless Compromise and Intrusion Detection System For Linux

An eBPF-powered Active Defense system that turns your Linux server into a deceptive honeypot. Features transparent traffic redirection, OS fingerprint spoofing, kernel-level DLP, and Zero Trust SSH access (SPA).

Extensible MacOS system telemetry generator.

A Deception Security Layer for MCP Servers. It injects "ghost tools" (fake security-sensitive tools) that act as honeypots.