Baiting

In a typical baiting attack, a malicious actor leaves infected USB drives in a parking lot, lobby, or elevator, hoping an employee will plug one into a work computer out of curiosity. Online, the bait is often a free download, pirated software, or a fake prize notification that installs malware when opened. The attacker relies on the target's curiosity or desire for something free, which lowers normal caution about unknown files or devices.

Baiting works because it exploits basic human impulses rather than technical weaknesses, so it can succeed even in organizations with strong perimeter security. Physical baiting is a particular concern in office environments with shared spaces, such as bank branches or government buildings, where an unfamiliar USB drive can go unnoticed among staff belongings. A single infected device connected to an internal network can give an attacker a foothold for further compromise.

Organizations should establish and enforce a policy against plugging in unknown removable media, and disable autorun on all endpoints. Employees should be trained to report found devices to IT rather than inspecting them personally, and to treat unsolicited free offers online with the same skepticism as suspicious email links. Endpoint protection that blocks unauthorized USB devices adds a technical layer of defense against this human-focused tactic.