What is baiting?
Baiting is a social engineering attack that offers something tempting, such as a free download, a gift card, a leaked document or a USB drive left in a parking lot, to get the target to install malware or enter their credentials.
How it works
Online baiting uses fake software, pirated media and “exclusive” files. Physical baiting uses labeled USB drives, such as “Salaries 2026”, that run malicious code when plugged in.
Device control, application allowlisting and training on unexpected offers reduce the risk.
Why it matters
Baiting exploits curiosity and reward, two instincts that compliance training rarely addresses.
