At 02:14 UTC a decoy Microsoft 365 sign-in page in a medium-interaction honeypot logged twelve POSTs from three residential proxy addresses. Each request carried the same custom User-Agent, a shared JavaScript fingerprint, and a redirect parameter shaped like a legitimate OAuth authorize URL. Ninety minutes later the SOC saw an email bomb against a finance mailbox: dozens of password-reset and SaaS sign-up notices arrived in under four minutes. The reset links and the honeypot posts shared one hosting ASN and one TLS certificate SAN pattern. The honeypot had already labeled the tooling cluster before the mailbox flood hit the ticket queue.
That pattern tracks the current landscape of OAuth attacks and the rise of email bombing as cover for credential theft. Attackers also lean on AI agents and scripted planners to generate lure copy, rotate decoy domains, and sequence multi-step crime kits. Honeypots remain one of the few sensors that record raw client behavior against fake identity surfaces before those campaigns touch production IdP logs.
Why identity decoys earn a place in the TI stack
Classic network honeypots catch exploit scouts and botnet sweeps. Identity-facing decoys catch a different buyer: operators who need valid sessions, consent grants, or password dumps. For cybersecurity teams and IT administrators, those captures convert into indicators that blocklists alone rarely publish early enough.
Useful honeypot outputs for threat intelligence include:
- Full HTTP request lines, headers, and body fields against fake /login, /oauth2/authorize, and /consent endpoints
- Credential tuples submitted to decoy forms, including password reuse patterns across tenants
- Client TLS JA3/JA4 hashes, HTTP/2 settings, and headless-browser markers
- Redirect URI templates that mirror real OAuth phishing kits
- Source IP, ASN, reverse DNS, and proxy-exit churn across a single tooling family
Recent reporting on AI-assisted cybercrime planning and tools such as ARTEX-style assistants shows operators can iterate lure text and target lists quickly. Your decoy still sees the fixed parts of the kit: form field names, callback parameter order, and the CDN path layout that automation reuses.
Stand up decoys that attackers actually hit
Low-interaction HTTP responders work for volume. Medium-interaction login and OAuth façades work for tooling fingerprints. Place them on dedicated prefixes or disposable cloud projects so production auth never shares certificates or cookies with the trap.
Build the surface attackers expect
- Clone the visual shell of a common SSO or SaaS login, including a plausible OAuth consent step that never issues real tokens.
- Accept POSTs, store them immutably, and return believable error pages so scanners stay engaged for a second round.
- Expose a small set of decoy markdown or documentation URLs if you want coverage of in-the-wild tricks that abuse AI agents’ trust in rendered links and instructions. Log every fetch of those files the same way you log login posts.
- Keep secrets out of the honeypot. Use throwaway certs, empty backends, and write-only storage into your SIEM or object store.
Kaspersky and peer vendors have published guidance on deploying AI agents securely; treat your own internal assistants the same way you treat production IdPs. Point them only at approved tools, and keep honeypot telemetry out of any agent context that can execute actions.
Instrument for joins, not screenshots
Ship structured events with a stable schema: timestamp, decoy_id, uri, method, ua, tls_fingerprint, src_ip, asn, body_hash, redirect_template, and session_id. Analysts need same-hour joins against mail gateway floods, IdP risk events, and edge WAF blocks. Payload hashes alone age out during patch weeks when Microsoft and other vendors ship large flaw batches and scout traffic mutates overnight.
Detection steps that turn hits into campaign packages
When the decoy lights up, run a fixed detection sequence before anyone argues about attribution.
Cluster by tooling, then by infrastructure
Group sessions that share form field order, OAuth parameter names, and script hashes even when source IPs rotate through residential proxies. Email bombing campaigns often spray sign-up and reset messages from one set of addresses while credential harvesting kits probe from another. Shared JavaScript, redirect templates, or certificate SANs bind those streams into one campaign package.
Score freshness against your own allow and auth logs
For each clustered source prefix, check whether the same TLS fingerprint or User-Agent appeared on real admin portals, remote support gateways, or partner OAuth apps in the prior 72 hours. A honeypot-only cluster still yields block candidates. A honeypot-plus-prod cluster becomes an active intrusion hunt.
Watch for AI-shaped cadence
Human spray often shows irregular pauses. AI-assisted planners and agents produce tighter intervals, repeated markdown-derived payloads, and rapid domain rotation with identical path structures. Flag sessions where documentation decoys and login decoys are hit in a fixed sequence within seconds. That sequence is a strong tooling indicator even when every IP is new.
Extract publishable indicators with owners
From each confirmed cluster, export:
- Domain and URL path templates for OAuth lures
- Certificate fingerprints and hosting ASNs
- UA strings and TLS client fingerprints
- Submitted credential formats that match your password policy enough to fool users
- Mail bombing source patterns tied to the same ASN or cert family
Assign an owner and an expiry on every indicator before it enters an ISAC share or an autodrop rule.
Response actions once the package is ready
Move from capture to containment on a clock measured in hours, not after perfect naming of the threat actor.
- Contain identity surfaces. Tighten consent app review, revoke suspicious OAuth grants, and raise step-up on admin and remote-support planes that match the honeypot UA or TLS profile.
- Correlate the mailbox flood. Join email-bomb message-IDs and reset destinations to the honeypot cluster. Quarantine related mail rules and force password resets only for accounts that also show matching auth anomalies.
- Apply temporary ASN or prefix caps on auth ingress when the cluster’s hosting tenure is short and peer reputation is poor. Keep partner corridors documented so countrywide denies do not strand legitimate tenants.
- Push partial notes upstream. Share the redirect template, JA4 hash, and decoy session timeline with your ISAC while attribution remains open. Waiting for a finished actor name burns the same window attackers use to rotate infrastructure.
- Retune detections. Add WAF and IdP rules for the observed parameter order and consent path. Retire rules that only matched yesterday’s domains.
- Tabletop the fail path. Confirm scrubber or edge rate controls do not hide the next probe wave from your honeypot sensors, and verify SIEM joins still complete under advisory-driven traffic spikes.
A practical weekly operating rhythm
Treat honeypot TI as a product with a backlog. Each week, review top clusters, retire stale decoy certificates, rotate lure themes that mirror active OAuth phishing language, and sample one email-bomb incident for cross-joins. After large vendor patch drops, expect scout volume to rise on edge appliances and identity portals together; keep decoy capacity ahead of that surge so captures stay complete.
Chinese-language reporting on long-lived cloud abuse families and Referer time-window variants underlines the same lesson for Western SOCs: operators iterate delivery tricks while keeping backend tooling stable. Your honeypot should prioritize those stable kit features over chasing every new domain string.
Takeaways for practitioners
- Put medium-interaction login and OAuth façades on isolated infrastructure and log structured fields ready for SIEM joins.
- Cluster on kit fingerprints first, infrastructure second, especially when residential proxies and email bombs split the visible source set.
- Feed honeypot clusters into same-day IdP, mail, and edge response with owned, time-boxed indicators.
- Include decoy docs that surface AI-agent link-following behavior alongside classic credential posts.
- Publish partial campaign notes early; honeypot timelines often beat breach notices and finished attribution.
Honeypots earn their keep when they turn anonymous scout noise into reusable tooling signatures. Against OAuth lures, email bombs, and AI-assisted crime kits, those signatures are what let defenders act while the infrastructure is still cheap to disrupt.
