{"id":34635,"date":"2026-10-07T13:36:01","date_gmt":"2026-10-07T13:36:01","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=34635"},"modified":"2026-10-07T13:39:28","modified_gmt":"2026-10-07T13:39:28","slug":"canary-tokens","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/canary-tokens\/","title":{"rendered":"Canary Tokens: An Early Warning Against Unauthorized Access"},"content":{"rendered":"\n

By Guillermo Pereyra<\/a><\/p>\n\n\n\n

In the past, coal miners would enter underground tunnels carrying a canary in a cage. If the bird stopped singing, it was a warning that there was toxic gas in the air and it was time to escape.<\/p>\n\n\n\n

We face a similar challenge in security. Many intrusions go undetected for weeks or months. By the time the attacker is discovered, they have already moved through the network, copied what they wanted, and left. Canary tokens propose a very simple idea: place small enticing traps in strategic locations and wait for someone to trigger them.<\/p>\n\n\n\n

In this article, we will explore what canary tokens are, how they work, how to deploy them in minutes, and the scenarios in which they can be useful.<\/p>\n\n\n\n

<\/a>What Are Canary Tokens?<\/h2>\n\n\n\n

A canary token is a digital decoy, such as a file, credential, URL, or domain name, that has no legitimate use. No one should ever open or use it. Therefore, if someone finds and uses one, the token triggers an alert providing clear evidence of access, leaving little room for doubt.<\/p>\n\n\n\n

Canary tokens are based on a simplified version of the concept behind a honeypot. There is no need to set up a complex server or simulate a service. All you have to do is place the decoy where an attacker is likely to look and configure where the alert should be sent.<\/p>\n\n\n\n

<\/a>How Do They Work?<\/h2>\n\n\n\n

Each token carries a unique identifier that triggers an action when activated. This action might be a DNS query, an HTTP request, or the use of a credential against a cloud service.<\/p>\n\n\n\n

For example, a Word document might contain a reference to a remote resource hosted at a unique URL. When the document is opened in Microsoft Office, the program attempts to load that resource, and the token’s server logs information such as the IP address, date, time, and user agent. Seconds later, an alert arrives via email or webhook.<\/p>\n\n\n\n

A DNS token can work even on networks that block outbound Internet access, as the query travels through the recursive resolver to the authoritative server for the token’s domain.<\/p>\n\n\n\n

<\/a>How to Deploy Canary Tokens<\/h2>\n\n\n\n

The best-known tool is CanaryTokens, created by Thinkst. It is available at no cost through canarytokens.org and does not require user registration. Given its open-source nature, any organization can host its own instance using Docker.<\/p>\n\n\n\n

Creating a token takes just a few minutes:<\/p>\n\n\n\n

    \n
  1. Select the type of token you wish to create: Office documents or PDFs, URLs, DNS records, QR codes, API keys (such as AWS or SendGrid), SQL Server databases, decoy executables, or fake login pages, among others.<\/li>\n\n\n\n
  2. Specify the destination where the alert will be sent, either an email address or a webhook that forwards alerts to Slack, Teams, or your SIEM.<\/li>\n\n\n\n
  3. Write a descriptive reminder, for example, \u201cpayroll spreadsheet on the HR file server.\u201d When the alert arrives, this text will tell you what resource was accessed and where.<\/li>\n\n\n\n
  4. Download the token and store it in a location where an attacker would actually look: code repositories, configuration files, shared folders, or CI\/CD variables.<\/li>\n<\/ol>\n\n\n\n

    A few best practices make a difference. It is advisable to use a different token for each location; this way, when one is triggered, you know the attacker’s point of entry. It also helps to assign them credible names (e.g., AWS_CREDENTIALS raises less suspicion than CANARY_AWS) and to test them after installation to confirm the alert is received. If a token is triggered, you should ideally preserve it for forensic analysis and replace it with a new one.<\/p>\n\n\n\n

    This technique works in the real world: in 2025, Grafana Labs detected an intrusion when an attacker who had stolen secrets from their GitHub repositories attempted to validate an AWS key that was, in fact, a canary token. The alert was received instantly, and the incident was contained within minutes.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    <\/a>Use Cases<\/h2>\n\n\n\n