A .zip bundle of pre-baited files, all wired to the same key. Drop the extracted folder on a shared drive; the mantis fires when someone opens one of the documents, double-clicks a shortcut, or follows the URL written in a text file.
The unzipped folder contains 9 bait files, each independently triggering the same key: Note: this does not fire automatically when someone browses the folder in Finder/Explorer — that requires DNS infrastructure (a future stage). What it does give you is high-surface honeypot detection: a curious user spelunking the directory is likely to open one of the documents or follow one of the URLs, and any of those triggers the alert. Fake credentials in passwords.txt / database-credentials.txt use AWS’s and Stripe’s documented example keys (AKIAIOSFODNN7EXAMPLE, sk_live_4eC39HqLyjWDarjtT1zdp7dc) — publicly known fakes, not real credentials anywhere.