Quick answer: Baiting is a social-engineering technique that offers something attractive or intriguing to make a person perform an unsafe action. The bait may be a found USB drive, free software, a prize, an “exclusive” document, or a fake update. Do not connect unknown media, run unexpected files, or exchange credentials or payment for the promised reward.
How a baiting attack works
The attacker first creates a lure tailored to curiosity, urgency, greed, fear of missing out, or a desire to help. The victim then takes an action—plugging in media, opening a file, installing software, enabling a browser permission, or entering information. That action can deliver malware, disclose credentials, enroll the user in a paid service, or give an attacker remote access.
Baiting describes the psychological lure, not one particular technical payload. It may be combined with phishing, malicious advertising, fake support, or a physical intrusion. Unlike a generic phishing message that primarily asks the recipient to trust a pretext, baiting emphasizes a promised item or benefit.
Common baiting examples
- Unknown removable media: a USB drive labeled “Payroll,” “Confidential,” or “Photos” is left where an employee may find it.
- Free or cracked software: a download promises a paid application, game cheat, codec, or license key but installs an infostealer or remote-access tool.
- Prize and giveaway pages: the reward requires a sign-in, card details, shipping payment, notification permission, or app installation.
- Exclusive documents: leaked salaries, customer lists, invoices, or recordings are packaged in an archive or disk image.
- Fake updates: a site claims the browser, media player, or security tool must be updated through a supplied installer.
Warning signs
Be suspicious when the value of the offer is much greater than the effort required, when a file comes from an unverifiable source, or when instructions ask you to disable protection, enable macros, bypass an operating-system warning, paste commands, or install a remote-support tool. A countdown, limited supply, or requirement to act secretly is designed to reduce verification.
How to prevent baiting
- Obtain software and updates from the operating system, official app store, or vendor site reached independently.
- Turn unknown removable media over to security or IT. Do not connect it to a personal computer “just to check.”
- Disable automatic execution from removable media and restrict unapproved USB storage where the business risk justifies it.
- Use application allow-listing, least privilege, endpoint protection, web filtering, and protected backups.
- Train with realistic examples and provide an easy reporting channel. Do not punish people who report a mistake quickly.
Organizations that must examine found media should use a documented forensic process and isolated equipment. A virtual machine alone may not contain every malicious USB device because some attacks target firmware, drivers, or the host’s USB stack.
What to do if you took the bait
If you connected unknown media or ran a file, stop interacting with the device, disconnect its network connections, and contact security. Record what happened and when; do not delete evidence or reconnect the media elsewhere. Scan and investigate the endpoint, review process and network telemetry, and rebuild it if integrity is uncertain.
If you entered a password, change it from a known-clean device, revoke sessions, review MFA and account-recovery settings, and report the message or site. Contact the payment provider immediately if card or banking data was submitted. Remove unwanted browser notification permissions if the lure used them, but do not assume that browser cleanup is enough after an executable ran.
Source
The removable-media risk and mitigation of limiting USB devices align with MITRE ATT&CK technique T1091.