Baiting vs phishing: what is the difference?

Phishing pushes a lure at the target. Baiting leaves something the target chooses to pick up, such as a USB drive, a free download or a gift-card offer, so the victim initiates the compromise themselves. That voluntary step is what makes baiting hard to train against.

Phishing requires the attacker to reach an inbox and survive a filter. Baiting skips both. Nothing arrives, so nothing can be scanned. The attacker relies on curiosity, or on the appearance of a legitimate free item, and the victim performs the action that grants access.

Baiting is also often physical, which puts it outside every email and network control an organisation owns.

Documented cases

• Operation Buckshot Yankee cost an estimated $155M. An infected USB drive left in a car park was picked up and plugged into a US Central Command laptop, and the cleanup ran for 14 months.
• The Stuxnet operation against Natanz reached an air-gapped facility the same way, because removable media crosses a boundary the network cannot.
• A field experiment at the University of Illinois in 2015 quantified it: of 297 drives dropped on campus, 98 per cent were removed from where they were left, and 45 per cent had files on them opened.
• FIN7 mailed BadUSB devices alongside real Best Buy gift cards in 2020, which shows the same idea run as a deliberate postal campaign.

The control that breaks it

• Disable autorun, block unknown USB mass-storage devices by policy, and use application allowlisting so an executable from removable media cannot run.
• The behavioural half matters just as much: give people a no-blame route to hand in a found device, because the alternative is that someone plugs it in to find out whose it is.