Baiting: The Physical Trojan Horse
Baiting attacks use a physical object — most commonly a USB drive — as the lure. The attacker leaves infected drives in locations where target employees will find them: parking lots, break rooms, conference rooms, or even mailed directly to the office.
The psychology is simple: people are curious, and finding a USB drive triggers the question "what's on this?" Security researchers at the University of Illinois dropped 297 USB drives around a university campus. 98% were picked up, and 45% of finders plugged them in and opened files. When the drives were labeled with something enticing (like "Salary Information Q4"), the plug-in rate was even higher.
When plugged in, the drive can:
* Auto-execute malware via Windows AutoRun (if not disabled)
* Present a convincing fake login page to harvest credentials
* Install a remote access trojan (RAT) silently in the background
* Simply open a file that exploits a vulnerability in the document viewer
The Mitigation: Disable USB mass storage on all corporate endpoints via Group Policy (Windows) or MDM policy (macOS/Linux). Even if an employee plugs in a drive, the OS ignores it. Endpoint Detection and Response (EDR) tools can alert on USB insertion events.
Quid Pro Quo: The Fake Favor
Quid pro quo attacks offer something in exchange for information. The classic example: an attacker calls random internal extensions claiming to be IT support conducting a "security audit." They offer to help speed up the employee's computer in exchange for their login credentials to "run the diagnostic tool."
Unlike pretexting, which builds a detailed false scenario, quid pro quo is often opportunistic and low-effort. The attacker is betting that enough employees will accept the offer without scrutiny.