Lure: open-source credential lures that alert on use, not on open (self-hosted, stdlib Python)
Source Reddit ThreatIntel
Discussion
Lure is an open-source deception tool that plants fake credential files on a network to detect intruders by alerting on credential use rather than file access. It runs locally on Linux and Windows machines using only standard Python libraries and sends alerts to local dashboards or collaboration platforms without involving external services. The tool is designed to detect attackers who hunt for saved passwords after gaining network access by triggering alerts only when bait credentials are used, avoiding false positives from antivirus scans or backups. It supports various bait types such as spreadsheets, RDP files, VPN profiles, and git credentials, and is intended as a safety net for networks ranging from home setups to enterprise environments. Currently, it is in beta and does not support macOS. The tool is not a vulnerability but a security detection aid.
r/threatintel (opens in a new tab)u/johncross080 points0 comments
I built this over the last few weeks and released it on 8 Nov. It’s a beta.
The idea: when someone gets into a network, the next thing they do is hunt for saved passwords. Lure plants fake ones where they look (a passwords spreadsheet, an RDP file, .git-credentials, a VPN profile, a QR code on a helpdesk notice, a DNS name for a backup server that doesn’t exist). The files only point at a listener machine you control.
The part I care about: it alerts when a credential is used, not when a file is opened. So AV scans, backups and indexers never fire it. You get one alert saying which bait was used, where it was planted, and the order the attacker went through the baits.
What it does:
- runs on your own machines, nothing is sent anywhere
- standard-library Python only, Apache-2.0, no dependencies
- local dashboard, plus Slack, Teams and Discord alerts
lure watchalso catches bait usernames typed into real SSH/VPN/AD logs- has an MCP server so an agent can check status and rotate baits
Try it without setting anything up:
git clone https://github.com/SilentMesh-Systems/Lure && cd Lure && python3 -m lure demo
It plants baits on localhost and plays a fake attacker, about a minute.
Limits, so nobody is surprised: Linux and Windows only for now, no macOS. The AWS bait keys are a preview and not tested live. It’s a tripwire for after someone is inside, not a way to keep them out