By creatively combining properties of various document viewing environments with canary tokens, we are able to gain valuable information directly from our attackers and their victims. These ‘baited’ canaries act as mixture between trip-wires and call back beacons and give us the unique opportunity to detect attacks against our users before they happen.