Arctic Wolf Releases Decipio – A Community Security Tool Targeting Credential Theft

Cybersecurity company Arctic Wolf has released Decipio, a community-shared defensive tool designed to catch attackers at the moment they attempt to steal credentials inside a network.

The tool is available through a gated beta programme open to verified security practitioners, including those at Australian organisations.

Catching credential theft early

Credential theft remains one of the most common ways cyberattacks begin and one of the hardest to detect in the early stages. Arctic Wolf’s own annual threat report consistently identifies stolen credentials as a primary initial access vector.

The problem for defenders is that credential theft is often only identified after the stolen credentials have already been used to move laterally through a network or cause damage. By that point, the attacker has a foothold and the scope of the incident has expanded considerably.

Decipio is designed to break that pattern by exposing credential-stealing activity as it happens, rather than after the fact.

Ismael Valenzuela, VP of Threat Intelligence Research at Arctic Wolf, described the tool as a response to the increasing speed and stealth of modern attacks.

“As attackers automate faster and operate more quietly, defenders can’t afford to only respond after the damage is done,” Valenzuela explained.

“Decipio represents a defence-first approach to AI-powered attacks that is designed to catch threat actors the moment they reveal themselves and gives defenders the home-field advantage.”

How Decipio works

Unlike traditional detection approaches that focus on post-compromise behaviour, Decipio functions as an early-warning tripwire. It is designed to reveal attackers when they attempt to steal credentials using common Windows network techniques such as LLMNR and NBT-NS abuse.

LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) are legacy name resolution protocols in Windows environments that attackers routinely exploit to intercept credentials on local networks. When a machine fails to resolve a hostname through DNS, it falls back to these protocols, broadcasting the request to the local network. An attacker listening on the same network segment can respond to that broadcast and capture the requesting machine’s credentials.

It is a well-known technique, but one that remains effective because these protocols are still enabled by default in many enterprise Windows environments.

Decipio’s detection signal is binary, meaning it either fires or it does not. Arctic Wolf says this approach requires minimal tuning and delivers clear, high-confidence evidence for rapid investigation, avoiding the alert fatigue that plagues many detection tools.

Why gated access

Arctic Wolf has opted not to fully open-source Decipio, instead releasing it as a limited, gated community beta with access reviewed and granted to verified defenders.

The company’s reasoning is that in an environment of large-scale scraping and automated reuse by AI, fully open-sourcing defensive tools can unintentionally help attackers understand and evade the techniques those tools are designed to detect.

Gated access is intended to allow Arctic Wolf to share the capability with legitimate security practitioners while reducing the risk of it being reverse-engineered or repurposed by threat actors.

“By sharing this tool with the community, we’re inviting practitioners to help shape how AI is applied responsibly in cyber defence,” Valenzuela added.

The Australian context

The tool arrives at a time when credential-based attacks remain a persistent challenge for Australian organisations. Phishing campaigns designed to harvest login credentials continue to be a leading entry point for breaches across both the public and private sectors.

The rise of AI-enabled phishing has added urgency to the problem. Attackers are using generative AI to craft more convincing phishing emails at scale, making it harder for users to identify malicious messages and increasing the volume of credentials being stolen.

For Australian organisations, particularly small and mid-sized businesses that may lack dedicated security operations teams, tools that provide clear and immediate signals of credential theft could help close a gap in early detection.

Arctic Wolf works with hundreds of SMBs and mid-market organisations in Australia, including Arts Centre Melbourne, Parramatta Eels and Brighton Grammar School, and employs around 70 local staff.

A community-driven approach

Decipio is being positioned not just as a product release but as a collaborative effort. Arctic Wolf is inviting security practitioners to participate in the beta and help shape how the tool develops.

The tool will be introduced publicly during the SANS AI Summit, where Arctic Wolf is presenting alongside security researchers and practitioners.

The community-driven model reflects a broader trend in cybersecurity where vendors and practitioners share tools, intelligence and techniques to collectively raise the bar against attackers. The gated model attempts to balance that openness with the practical reality that defensive tools can be studied and circumvented if made freely available.

For more information or to request access to Decipio, visit arcticwolf.com/decipio.

Last Updated on April 22, 2026 by Nick Ross