Overview
Baiting is social engineering that exploits curiosity or greed by offering something enticing — a "bait" — that leads the victim into a trap. It can be physical (a planted USB drive) or digital (a too-good-to-be-true download).
Learning objectives
- Define baiting and its common forms.
- Explain the human tendencies it exploits.
- Recognize and avoid baiting traps.
Core concept
Baiting lures victims with the promise of a reward or something interesting:
- Physical baiting: infected USB drives left in parking lots, lobbies, or labelled enticingly ("Salaries 2024," "Confidential"). A curious finder plugs it in, and malware runs.
- Digital baiting: free movies, games, software, or "prizes" that carry malware, or fake download buttons and offers.
The lure works because it appeals to curiosity, greed, or helpfulness — a found USB might be returned to its owner, a "free" premium app is tempting.
How it works
The attacker relies on the victim taking the final action themselves: inserting the device or running the download. Physical baiting can bypass network defenses entirely, since the malware enters through a USB port from inside the building. Some malicious USB devices even emulate a keyboard to type commands automatically the moment they are connected — no file needs to be opened.
Practical example
An attacker scatters several USB drives labelled "Employee Bonuses" in a company car park. An employee finds one, plugs it into their work laptop out of curiosity, and it silently installs a backdoor — giving the attacker a foothold inside the network without ever touching the firewall. The defenses: never plug in unknown devices, disable auto-run, and use USB-port controls.
Cybersecurity relevance
Baiting demonstrates that the human and physical attack surfaces are real entry points, not theoretical ones. It reinforces controls like disabling auto-run, restricting USB usage, endpoint protection, and clear policies about unknown devices and downloads.
Common mistakes
- Plugging in found or unknown USB devices "just to see what's on it" or to find the owner.
- Downloading free/pirated software from untrusted sources.
- Assuming an air-gapped or firewalled network is safe from something carried inside on media.
Key takeaways
- Baiting lures victims with something enticing that delivers malware, physically or digitally.
- It exploits curiosity and greed and can bypass network defenses via USB.
- Never insert unknown devices or download from untrusted sources; disable auto-run and control USB use.
Check your understanding
- Why is a found USB drive a security risk even if you only want to identify its owner?
- How can baiting bypass a strong network firewall entirely?