Baiting.

Baiting exploits curiosity or greed by offering something attractive — a free download, a pirated movie, or a deliberately dropped USB drive labelled "payroll" — that secretly delivers malware or harvests credentials when used. The bait can be physical (rogue USB sticks left in parking lots) or digital (fake software cracks, malicious ads, decoy torrents). Once executed, the payload may install a backdoor, steal data, or pivot into the corporate network.

The physical variant is far from theoretical. In a controlled 2016 study, Tischer et al. dropped 297 USB drives across the University of Illinois campus; roughly 48% were picked up, plugged in, and had a file opened — the first within six minutes — most people acting out of a well-meaning wish to find the owner. In January 2022 the FBI's FLASH alert warned that the financially-motivated group FIN7 mailed "BadUSB" (LilyGO) devices to US defense, transport, and insurance firms, impersonating Amazon and HHS; the drives emulated a keyboard (a human-interface-device attack) to run PowerShell and Cobalt Strike, ending in BlackMatter and REvil ransomware. The technique traces back to BadUSB (Nohl and Lell, Black Hat 2014), which showed the USB firmware itself can be reflashed so no malicious file is ever stored on disk.

flowchart TD
  A[Attacker prepares bait] --> B{Delivery vector}
  B -->|Physical| C[Dropped or mailed USB drive]
  B -->|Digital| D[Fake crack, torrent, malvertising]
  C --> E[Curious victim plugs in / opens file]
  D --> E
  E --> F[Payload executes:<br/>HID keystrokes or autorun]
  F --> G[Backdoor, credential theft,<br/>lateral movement]
  G --> H[Ransomware / data exfiltration]

Defences include disabling USB autorun, blocking or allowlisting HID devices via endpoint policy, application allowlisting, endpoint protection that blocks unknown executables, user education about handling found or unsolicited media, and network segmentation that limits lateral movement after a single host is compromised.