The trick is to make the breadcrumbs the type of data that an attacker is interested in, but a regular user will never be aware of. For example in windows ther

The trick is to make the breadcrumbs the type of data that an attacker is interested in, but a regular user will never be aware of. For example in windows there is a cache of used credentials along with passwords, it is a known infection spreading technique to read that of an infected machine and use t across the network. A breadcrumb would put a decoy's credentials in that cache. Thereby never doing any side effect to the user and definitively flag attackers by looking at any usage of those credentials.