What Is Baiting in Cybersecurity: Definition, Examples, and Mitigations

Baiting represents one of the oldest scams on the Internet, but it remains one of the most common because of its effectiveness. By luring victims to accept phony offers, cybercriminals can trick targets into downloading malware, compromising credentials, or transferring funds. Both consumers and corporate targets can be vulnerable to baiting attacks.

Fortunately, when you know what to look for, baiting is easy to detect and deter. In this blog we'll share how you can protect your company against baiting attacks. We'll cover:

• What is baiting in cybersecurity?
• How baiting works?
• Common types of baiting
• How to detect baiting?
• How to prevent baiting?

What is Baiting?

Baiting is a type of social engineering that lures victims into accepting offers of free items, information, discounts, or rewards in return for disclosing sensitive information or taking compromising actions. For example, an ad might invite website visitors to click on an offer for a free movie download, but responding to the offer requires the victim to provide their email information, setting the stage for follow-up identity theft attacks.

Baiting attacks typically seek to trick victims into providing sensitive information, installing malware, or paying money. Criminals may use baiting to target both consumers and businesses. Bad actors may use both digital offers and physical items to launch baiting attacks.

Baiting resembles phishing in some ways, but the two tactics differ in key respects. Both baiting and phishing rely on social engineering to deceive victims. However, baiting offers something of apparent value in order to trick victims into responding. Phishing typically does not offer anything of value, but deceives victims into responding by impersonating legitimate sources and playing on trust, urgency, or fear. Where phishing relies on impersonation, baiting relies on con tactics.

How Does Baiting Work?

Baiting exploits victims' desire to get free items or satisfy curiosity. Baiting attacks unfold in stages:

• Attract the target's attention
• Entice the target into taking a compromising action
• Exploit the compromised target

First, the attacker attracts the victim's attention by creating a digital offer or leaving a compromised physical object, such as a USB drive with malware on it. Digital offers typically invite the target to click on a link, provide information, or invest a small amount of money in return for promises of a larger payoff. Scams using physical items leave the item out in a place where the target is likely to spot it.

Once the victim's attention has been gained, the attraction of the lure deceives the victim into taking an action which compromises their security. This can consist of actions such as providing email information, supplying credentials, disclosing personal or financial information, sending a payment, installing an infected file, or installing an infected device such as a USB.

After the victim has been compromised, the perpetrator may exploit the compromise based on the intended goal of the attack. Exploits may involve actions such as misusing stolen credentials, conducting surveillance on compromised systems, escalating privileges, making ransomware threats, transferring stolen funds, or disrupting networks.

What Are Some Common Types of Baiting?

Baiting attacks can take various forms. Some of the most common include:

• Clickbait
• Spear baiting
• Physical baiting

Clickbait

Clickbait uses attention-getting ads or news headlines to trick viewers into providing credentials or downloading malware. Sites and emails promoting clickbait scams use tactics such as:

• Inviting engagement through phony pop-up notifications, error messages, virus warnings, software expiration warnings, or browser extension and add-on offers
• Teasing visitors with incomplete story introductions or questions that require clicking to see the rest
• Making outrageous claims that sound unbelievable or too good to be true
• Offering free information, such as healthcare DIY tips ("one simple trick") or get-rich-quick scheme advice
• Offering free downloads of items such as music, videos, digital books, or software
• Promising premium products at extreme discounts
• Inviting viewers to participate in surveys, contests, lotteries, or sweepstakes
• Promoting news or gossip about celebrities or trending topics

These various clickbait tactics all seek to achieve similar outcomes:

• Tricking the victim into providing sensitive information, such as email addresses, login credentials, or financial data
• Luring the victim into clicking on a link that installs malware on their device
• Deceiving the victim into sending money

Most clickbait tactics target consumers, but these methods can be modified for deployment against business targets. For instance, business users can be tricked with phony software expiration warnings, software offers, or business news headlines.

Spear baiting

Spear baiting uses baiting tactics to lure specific users or organizations. They use information gained during prior reconnaissance to make lures more customized and convincing to targets. They may use advanced tactics, such as hijacking business emails to impersonate employers, hacking social media accounts to trick followers, or leaving voicemails with deepfakes mimicking the voice of a trusted source. When deployed against businesses, spear baiting tactics may aim to gain control of executive accounts and access privileges.

Physical baiting

Physical baiting tactics use a tangible item to lure a victim into a compromising action. For example, a bad actor may leave a USB drive infected with malware lying in an office lounge, intending for an employee to take it and install it. Similarly, a criminal may leave an infected smartphone to lure a victim. During the holiday shopping season, criminals may leave packages with malicious QR codes on victims' porches, luring recipients into scanning the code and following a link to a phony website.

How Can You Detect Baiting?

You can detect baiting using both manual and automated methods:

• Experience and training can teach employees to spot clickbait ad tactics, digital, and physical baiting scams
• Training employees to recognize common signs of baiting or phishing such as offers that seem too good to be true, misspelled words, an urgent request, or messages from unknown or suspicious senders, especially ones with attachments or links included.
• Automated tools such as antivirus and antimalware software can detect attempts to install malicious code on devices

Both manual and automated methods play important roles in detecting baiting attempts. Manual methods can prevent employees from responding to baiting lures. Automated tools can intercept baiting attacks that are already underway and stop them from installing or deploying viruses and malware. Use manual methods to pre-empt baiting attacks and automated methods to keep successful baiting attacks from escalating.

Prevent Baiting by Building a Security-conscious Culture

You can reduce the risk of baiting harming your business by building a security-conscious culture. Mitigate baiting risk by taking steps such as:

• Training employees to spot common baiting tactics and follow security best practices
• Keeping software updated to incorporate the latest security patches
• Maintaining antivirus and antimalware software
• Scanning devices to detect malware
• Developing standard operating procedures for detecting, reporting, and responding to suspicious activity

A formal security awareness training program can help you instill security awareness in your corporate culture.

Protect Your Company from Baiting with Cobalt Security Awareness Training

Baiting attacks can be devastating, but you can deter them by teaching your team to follow best practices for defending against social engineering. To keep your company safe, Cobalt provides professional phishing simulation services for businesses. We'll help you test your employees' ability to spot social engineering attacks, and we'll also help you test your technical controls against simulated baiting or other common attacks such as phishing. Contact us to discuss how we can help you train your team to spot and stop social engineering attacks.