It's an interesting concept. But there's one thing that bugs me. If an attacker is already in the network, I think we need to distinguish between two types of boxes. Servers, and clients. Honeypots are nothing new, so having a few servers that are honeypots in the network doesn't seem that interesting to me.

If someone wants to break into your network, they'll probably target a small amount of users and try to get a RAT on their box to spread from their, I don't know but that's what I'd do.

If you want honeypot Clients, things get a bit harder, since you will need to mimic user interaction. But even if a box clicks every link for a decoy email account a drive-by exploit or something can easily fingerprint the system and bail out if it's a VM since it's unlikely for clients to be VMs. Depending on the exploit, that could be hard to detect.

So, we're back to honeypots as servers? I don't want to sound negative, but the article is just so vague and that seems to be the only plausible thing.