0x4d31/stinger

Stinger is a security tool for individual macOS and Linux computers that tries to catch malware or malicious scripts in the act of stealing secrets like login tokens, API keys, browser data, or crypto wallet files. It works by placing fake, decoy versions of these sensitive files and services around the system, then watching for anything that tries to read or interact with them, since a real user would have no reason to touch a decoy. Normal personal computers usually do not have the kind of security software that companies run on work laptops, so infostealer malware can quietly copy sensitive files during a single run and go unnoticed. Stinger aims to catch that interaction as it happens, rather than after the stolen data is later used somewhere else. The tool has two main modes. Watch Mode sets up standing decoy files and network sockets in the background while you use your computer normally, and records an event the moment something interacts with one of them. Protected Sessions instead wrap a single command or an entire terminal session, for example running npm install or opening a shell, inside a fake home directory filled with decoys and a trimmed down environment, so any credential stealing behavior triggered by that specific command gets caught in isolation. Decoy files called baits come in built in groups such as cloud credentials, identity files, package manager configuration, and developer tools, and you can also add custom file paths. On Linux, Stinger offers a few different technical backends for detecting file access, ranging from a default pipe based approach to an experimental mode that can outright block access to a decoy file, though that mode needs elevated system permissions. The project is explicit that it is not a full antivirus or endpoint monitoring system. It only reacts to interaction with the traps it sets, so it does not scan for malware, watch all file access on the system, or guarantee that every kind of credential theft will be detected. It is meant as an early warning layer that a technically inclined user can install and run on their own machine, alongside whatever other protection they already use.