Baiting Attacks Guide: Lures, Free Offers and Infected Media

A baiting attack is a social engineering technique that offers the victim something they want, such as a free download, a gift, a prize or a found USB drive, so that they run, open or plug in something the attacker controls. In plain terms, phishing pushes a message at you and asks you to act, while baiting leaves something attractive in your path and waits for you to pick it up. The lure can be physical (infected media left in a car park or sent in the post) or digital (cracked software, pirated films, free tools, fake game cheats or "claim your reward" offers). This guide explains how baiting works, why it keeps succeeding, where it overlaps with malvertising and cracked software, and which awareness and technical controls actually reduce the risk. It is written for security practitioners, awareness leads and endpoint teams.

Key takeaways

• Baiting exploits desire and curiosity, not fear. The victim goes looking for the lure or picks it up willingly, which is why urgency-focused phishing training often misses it.
• The digital form is the bigger volume problem. Pirated content, cracked software and free tools delivered through search results and adverts reach far more people than dropped drives.
• Execution is the attacker's goal. Almost every baiting chain ends with the user running a file (ATT&CK T1204.002) or plugging in hardware (T1200), so execution controls carry most of the defensive weight.
• Infostealers are the usual payload. A single baited download on a personal or contractor device can hand over browser-stored passwords and session cookies for corporate systems.
• Awareness plus technical defaults beats either alone. Teach people to recognise "too good to be true" offers, and make sure that when someone does take the bait, unknown executables, scripts and USB devices are blocked by default.

What it is

Baiting sits in the social engineering family alongside phishing, pretexting and quid pro quo. Its defining feature is the offer: the attacker supplies an item or reward and relies on the victim's own motivation to complete the attack. See the Social Engineering Guide for the wider family.

Physical baiting

• Dropped media: USB drives or memory cards left in car parks, receptions, lifts or conference venues, sometimes labelled to provoke curiosity. See the USB Drop Attacks Guide.
• Mailed devices: packages containing a USB device presented as a gift, a promotional item or an official mailing. In January 2022 the FBI warned that FIN7 had posted such packages to US businesses, impersonating Amazon and the US Department of Health and Human Services, as reported by BleepingComputer.
• Freebies at events: branded drives, chargers or cables handed out or left on tables. Charging lures are covered in the Juice Jacking Guide.

Digital baiting

• Cracked and pirated software: "free" versions of paid applications, key generators and activators, which by design ask the user to disable antivirus or run with administrator rights.
• Pirated media and streaming: sites offering free films or sport, monetised through malicious advertising redirects.
• Fake free tools: PDF converters, video downloaders, browser extensions, AI assistants or game cheats that deliver malware alongside, or instead of, the promised function.
• Reward and prize lures: "you have won" pages, gift card offers and fake surveys that lead to a download or a credential form.
• Shared-file lures: enticingly named files ("2026 bonus plan.xlsx") placed on file shares, collaboration sites or public repositories.

How it works

Whatever the lure, a baiting chain has the same four stages. Defenders can interrupt each one.

1. Staging the bait: the attacker prepares the lure and places it where targets will find it, for example by buying search adverts (ATT&CK T1583.008 Malvertising), compromising or creating a download site (T1608.004 Drive-by Target), seeding a torrent, or physically placing or mailing a device.
2. Attraction: the victim searches for something free, clicks an advert, or finds the object. The lure promises value: a working product, entertainment, money or the chance to return lost property.
3. Execution: the victim runs the installer, opens the document, follows instructions to disable protection, or plugs in the device. This is ATT&CK T1204 User Execution (T1204.002 Malicious File) for files, T1091 Replication Through Removable Media for infected storage, and T1200 Hardware Additions for malicious devices.
4. Payload and follow-on: the payload, commonly an infostealer, remote access trojan or loader, harvests credentials and cookies or opens a foothold that is later sold or used for ransomware.

The overlap with malvertising and cracked software

Digital baiting and malvertising are closely linked: the advert or poisoned search result is the delivery mechanism, and the free offer is the bait. Microsoft Threat Intelligence described a campaign, detected in early December 2024 and tracked as Storm-0408, in which illegal streaming sites embedded malvertising redirectors. Visitors passed through four to five redirect layers before reaching payloads hosted mainly on GitHub, with others on Discord and Dropbox. The payloads included Lumma Stealer, Doenerium and NetSupport RAT, and Microsoft said the campaign affected nearly one million devices across consumer and enterprise systems. The Malvertising and SEO Poisoning Guide covers the advertising side in depth; this guide focuses on the lure and the user decision.

Cracked software is the sharpest form of digital baiting because the victim is primed to accept warnings. Instructions to "add an exclusion", "turn off real-time protection" or "run as administrator" look normal to someone expecting a crack, so the usual safety cues are switched off by the user before the payload runs.

Why it matters

• It bypasses email defences: the victim reaches the payload through a browser, a torrent client or a physical port, not a mail gateway, so secure email gateway controls do not see it.
• It reaches unmanaged devices: people download free software and pirated content at home. If they then use the same browser profile or device for work, credentials and session cookies for corporate SaaS are exposed. See the Infostealer Threat Guide.
• Stolen credentials travel far: in the Snowflake breach, credentials harvested by infostealers on systems Snowflake did not own, including contractor laptops, were used to reach 165 customer data warehouses where MFA was not enforced. The page does not establish how those infections began, but it shows what infostealer output can unlock.
• Physical lures work quickly: in the 2016 University of Illinois and Google study, the first of 297 dropped drives was connected in under six minutes, and users mostly plugged them in to find the owner.
• It targets helpfulness as well as greed: training that frames victims as careless misses the altruistic motive, which is why "return found items to reception, never plug them in" must be an explicit rule.

Defences that work

Because the user is a willing participant, the control strategy is to make the safe path easy and the unsafe path technically difficult.

Awareness that fits baiting

• Name the lures: cracked software, free converters, game cheats, prize pages and found or mailed devices, with real screenshots rather than generic warnings.
• Give one rule per lure: "Only install from the company catalogue", "Hand found devices to security, do not plug them in", "Unexpected gifts with USB devices go to IT unopened".
• Make reporting easy and blame-free: a report button or a single mailbox, with a quick thank-you. People who report taking the bait early limit the damage.
• Test ethically: authorised USB drop or download-lure simulations, agreed with HR and legal, measure behaviour without punishing individuals. See the Security Awareness and Human Risk Management Guide and the Social Engineering and Physical Penetration Testing Guide.

Rolling out the technical controls

1. Discover: put the ASR rules above into audit mode and review AsrUntrustedExecutableAudited, AsrObfuscatedScriptAudited and AsrUntrustedUsbProcessAudited events in advanced hunting for two to four weeks.
2. Publish the safe path: stock the software catalogue with the free tools people actually look for (PDF, archive, screen capture) before blocking anything.
3. Pilot: move rules to block for IT and a volunteer ring, with a documented exclusion process. See the EDR Tuning and Exclusions Management Guide.
4. Enforce: roll out to all standard users, remove local admin rights, and enable web category blocking.
5. Roll back if needed: return a single rule to audit (action value 2) rather than disabling the set, and fix the cause through a narrow exclusion.

Small versus large organisations

A small organisation gets most of the value from three defaults: no local admin, the ASR rules in block, and AutoRun off, delivered through Intune security baselines. A large organisation adds application allowlisting for high-risk groups (finance, admins, developers), category-based web filtering, a browser policy that separates work and personal profiles, and telemetry-driven review of blocked events. See the Application Allowlisting Guide.

Detection and measurement

• What to monitor: ASR block and audit events, DeviceEvents RemovableStoragePolicyTriggered, downloads of executables and archives from file-sharing and code-hosting domains, processes launched from user Downloads and Temp folders, user-initiated attempts to change Defender settings, and new RMM tools appearing on endpoints.
• Identity signals: sign-ins from unfamiliar infrastructure using valid credentials or replayed sessions shortly after a suspicious download on the same user's device.

Common misconceptions

• "Baiting means dropped USB sticks." Physical drops are the textbook example, but the volume today is in digital lures delivered by search, adverts and file sharing.
• "Our users would never install pirated software." Most will not do it on a work laptop, but many do on home devices that sync the same browser profile, password manager or work sessions.
• "Antivirus will catch it." Cracked software instructions tell users to disable protection or add exclusions. Tamper protection and no local admin matter more than signatures.
• "Disabling USB storage solves the physical risk." Malicious devices that present as keyboards bypass storage blocks, as the FIN7 mailings showed. HID controls are a separate decision.
• "Phishing training covers it." Phishing training teaches suspicion of unexpected messages under pressure. Baiting needs its own examples because the victim initiates the action and feels in control.

Related concepts

Framework mapping

Practitioner checklist

• Remove local administrator rights from daily-use accounts and enable Defender tamper protection.
• Deploy the four ASR rules named above, audit first, then block.
• Publish a self-service software catalogue that covers the common free tools.
• Block piracy, warez and newly registered domain categories at the web or DNS layer.
• Disable AutoRun and apply removable media and HID policy from the Removable Media and USB Control Guide.
• Add baiting examples (cracked software, prize pages, found and mailed devices) to awareness content, with one clear rule each.
• Give staff one blame-free reporting route and a found-device hand-in process.
• Separate work and personal browser profiles and enforce phishing-resistant MFA on SaaS.
• Run an authorised baiting simulation annually and track the report rate.

Standards and references

• MITRE ATT&CK: User Execution: Malicious File (T1204.002)
• MITRE ATT&CK: Acquire Infrastructure: Malvertising (T1583.008)
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Threat Intelligence: Malvertising campaign leads to info stealers hosted on GitHub
• Google Research: Users Really Do Plug in USB Drives They Find
• BleepingComputer: FBI: Hackers use BadUSB to target defense firms with ransomware

Related NHI Mgmt Group resources: Social Engineering Guide · USB Drop Attacks Guide · Malvertising and SEO Poisoning Guide · Infostealer Threat Guide