Baiting leaves or offers an enticing item — a physical device, a free download, a “found” file — engineered so your curiosity or desire for reward leads you to take a risky action that grants the attacker access. It inverts the usual social-engineering direction: instead of approaching the target, the attacker leaves an attractive object where a target will find it and lets curiosity do the recruiting.
The classic physical form is the “road apple” — a USB stick dropped in a parking lot, lobby, or restroom, sometimes labeled to increase intrigue (“Payroll Q3,” “Confidential”). Plugged in, it delivers a payload: auto-run code, a device that masquerades as a keyboard to inject commands, or simply a tempting file. The digital form is far larger in volume — fake “cracked” software with a keygen, a movie or game “crack,” a “free” premium app, a required “codec,” or malicious QR codes on flyers and prize notices. The unifying logic is a value-for-nothing offer that lowers your guard, because the object appears to benefit you.
Baiting differs from phishing, which pushes a deceptive message, by its pull structure — you initiate contact with the lure. Its defining feature: the payoff to the attacker depends entirely on your own curiosity or desire for a freebie overriding your security caution.