PATENT PENDING · BROWSER CREDENTIAL DETECTION
Hookset plants synthetic credentials and session cookies directly inside Chrome's credential stores. When an attacker validates what they stole, you get a confirmed detection with exact endpoint attribution. No guesswork, no triage sprawl.
HOW IT WORKS
Hookset operates outside the malware execution chain entirely. It catches commodity infostealers that bypass EDR and only fires when there is confirmed attacker activity on the other end.
Credentials injected at the source
Synthetic passwords and session cookies are written directly into Chrome's credential stores in a format indistinguishable from the real thing. Every harvesting tool treats them as legitimate.
Infostealer takes the bait
When a commodity infostealer runs on the endpoint, it exfiltrates the honeytoken credentials alongside everything else. No special behavior is needed to trigger detection.
Attacker fires the alarm
The moment stolen credentials are tested against Hookset's infrastructure, a confirmed detection event fires with full endpoint attribution, a timestamp, and attacker signal. No triage required.
FEATURES
Every design decision in Hookset traces back to real infostealer behavior and IR workflow pain that most tools never address.
Honeytoken passwords and cookies are written in a format native to Chrome's credential stores. There is no fingerprint for attackers to pattern-match against in exfiltrated dumps.
Cookie honeytokens are device-bound by design. When one fires, you know exactly which machine was compromised. No ambiguity, no cross-device noise.
Detection happens server-side at the point of credential validation, not on the endpoint. Infostealers that fully evade your EDR are still caught the moment the attacker tries to use what they took.
Honeytokens are built to survive criminal log filtering. They look like the kind of access attackers actually care about, using your customer's real domain.
No SIEM rules. No behavioral thresholds. No false positives. A Hookset alert means an attacker validated stolen credentials. That is the whole signal.
Multi-tenant architecture, per-customer dashboards, configurable retention windows, and a lightweight Windows deployer. Built for managed service delivery from the start.
USE CASE
This is the scenario Hookset was built to solve.
WITHOUT HOOKSET
Your IR team has to treat every machine that user touched as potentially compromised. Workstations, jump boxes, shared servers. That is 8 to 12 endpoints to analyze and remediate. Weeks of work and massive scope creep on every single incident.
WITH HOOKSET
GET IN TOUCH
Hookset is in active development and we are selectively onboarding early partners. If you run an MSSP or are a security team dealing with infostealer exposure, reach out.
