Millions of malicious Internet-wide scans are happening on a daily basis, looking for exposed sensitive files on insecure Internet-facing servers. Corporate info, sensitive data and personal files are always the most popular juicy targets.

What if we could easily craft a 'tailor-made' deceptive file, let it get stolen on the Internet, and get it to notify us with the 'thief' information?

In this session, we will showcase an interesting recent 90-day real-world use case, by spreading '$100,000 worth' Bitcoin wallets on the Internet with different means selectively. These wallets were embedded in 'tailor-made' archive files, with custom alerting mechanisms. Surprisingly, all wallets were stolen, and some of them within just minutes!

We will share the technique in detail, the do's and don'ts, and the lesson learned. We will dive deep into the interesting results collected, the unexpected fruitful observations, and expose the 'thief'. We will release 'Honeybag' - a new open-source honeyfile which everyone can easily craft, with tailored alerting mechanism and support for any embedded decoy documents. This will be useful in data breach detection and cybercrime investigation.