Let Us Guide You Through Your InfoSec & Compliance Journey.
Learn how to use the Compyl Platform.
Watch all Security Session Episodes
Real-world stories on how we help our customers.
Baiting is a type of cyber attack that involves luring victims with an enticing offer or object to exploit their curiosity or greed. How would you react to a wallet lying on the sidewalk, with a wad of cash sticking out? Some people would take the money without thinking twice, and others would look for ID to try to return it. But what if the trap was simply getting you to pick up the wallet in the first place? In cyber security, baiting is just as hard to resist.
Baiting is a type of social engineering that involves tempting users. The goal is often to entice users to download or install malware. Baiting attacks can also try to convince victims to reveal personal information, such as passwords, user IDs, social security numbers, and banking information.
Baiting is similar to phishing; the main difference is the method of persuasion. Phishing attacks impersonate official websites or company personnel. Baiting always uses a reward or temptation — the “bait.”
Any time you receive a positive outcome or reward, the brain releases a feel-good neurotransmitter called dopamine. This process is responsible for the pleasant feelings you get after a favorite meal, gift, or even some chocolate. Baiting uses this natural desire against you by offering:
Curiosity can also be effective bait. Humans are curious, which is why mysteries, soap operas, and clickbait titles are so good at grabbing attention.
Victims reason, “A quick click can’t hurt.” Unfortunately, a single click is all it takes to unleash some cyberattacks.
It’s just as hard for business professionals to resist curiosity or temptation as much as anyone else. Stay alert to the following types of baiting attacks.
Baiting often takes advantage of people’s desire for deals or rewards, making them more susceptible to manipulation. One of the most common types of baiting is an offer that seems too good to be true:
The tricky thing about this type of offer is that years of “harmless” email offers can dull your sense of danger to real malware. Even if 95% of clickbait only leads to websites filled with ads, the other 5% can unleash a cybersecurity nightmare.
Fear of missing out can make baiting attacks even harder to resist. One example of baiting is a message like, “You only have three days left to claim your share of the Walmart class action lawsuit.”
Why is this message tempting? First, because it seems believable. Class action lawsuits and data breaches are common these days. You’ve probably done business with Walmart (or Wells Fargo, McDonald’s, United Airlines, Toyota, etc.), so you start to think, “Maybe this is legit.”
The time limit creates a sense of urgency. You have to decide quickly or miss out. “Today only” or “first 50 customers” messages push your brain out of the driver’s seat and let your excitement take over.
Emails with suggestive titles or files that have NSFW names can be hard to ignore, especially if the attachment seems to come from friends or workmates. This type of baiting often triggers malware or ransomware.
Cybercriminals can gain access to your system with physical media, such as USB drives. In this case, baiting involves leaving an infected device where employees are likely to find it:
The USB stick may have writing that builds curiosity in passersby, such as “confidential,” “private,” “leverage,” or “honeymoon pics.”
These days, the typical Nigerian prince scam has gone 2.0 with several updates:
Remember, the goal isn’t usually to get you to agree to send money. Often, it’s to steal your credentials or simply convince you to click on a link.
Scammers can combine baiting attacks with phishing to persuade employees effectively. For example, if you receive an email that looks like it comes from your bank, you’re more likely to fall for the bait. The email may say something like, “We accidentally took $1,000 from your account and need you to sign in to return it. We’re giving you an extra 10% payment as an apology for our mistake.”
You need to be on the lookout for this type of “mistake” at an organizational level, too. Make sure vendor or customer emails come from the company’s authorized address instead of taking them at face value.
To avoid falling for baiting attacks, your company needs good cyber hygiene at every level:
One of the most important defenses? Accepting the potential for failure. Despite your best efforts, if you have a lot of employees, it only takes one to fall for social engineering to trigger a cyber attack. Prepare for worst-case scenarios with mitigation strategies ahead of time.
Network monitoring can help you catch baiting attacks as they happen. With a cyber security platform like Compyl, IT personnel can view employee actions in real-time, flag suspicious activity/logins, and prevent unauthorized personnel from changing admin settings, accessing backups, or deleting security logs. Learn more about what baiting is and cyber security framework best practices right away.
