Hi Product Hunt, Password stealers stopped guessing a long time ago. They copy what's already on your computer: logged-in browser sessions, saved passwords, SSH and cloud keys, wallet files, and now the keys and configs AI agents use. It takes seconds and most people never notice. CyberShade is a small tray / menu-bar app that watches those few places. What it does - Plants 4 useless decoy credentials (fake AWS key, SSH key, seed phrase, secrets file), random per computer. Nothing legitimate reads them, so a read is a strong signal. - Watches the real stores (browsers, Discord/Telegram/Signal/WhatsApp sessions, SSH/AWS/GitHub/npm/Kubernetes credentials, MetaMask, Phantom, Coinbase Wallet, Ledger Live, Exodus, Electrum, Claude Code keys, MCP configs, Cursor rules) and names the program behind each read. - From the alert: Stop this process now, Quarantine this app (reversible) or Ignore. Auto-stop for decoy readers exists but is off until you turn it on. - Flags an MCP tool description or CLAUDE.md that was quietly rewritten after you trusted it. - Clipboard guard for swapped crypto addresses. - Server role: no pop-ups; alerts to Discord, Slack, Teams, a webhook or an email digest, each naming its computer. What it isn't: an antivirus, or a guarantee. Keep your antivirus. CyberShade won't catch every threat; it makes a thief's first move visible and gives you a way to act. It runs entirely on your machine. No account, no telemetry; nothing leaves unless you set up an alert channel. The 7-day trial has everything on. After that, watching and warning keep working; stopping programs, quarantine, auto-stop, the Server role and remote alerts need a license. Launch price is $29 for the first 4 weeks, then $49, one-time. Try Simulate a credential thief (demo) first: it's a harmless test that shows the whole chain. I'd love to hear what it flags on your machine, and what you'd want it to watch next.

CyberShade

Catch the program reaching for your keys and wallets

Catch the program reaching for your keys and wallets