Baiting is a social engineering trick that uses a tempting lure to make someone take an action that helps the attacker. The attacker does not push with a long story. They place or present an attractive item and wait. Curiosity, reward, or fear does the rest. The bait can be physical or digital. Digital bait includes free downloads, fake giveaways, and pop-ups that promise prizes or warn of fake problems. Links often lead to look-alike sites such as login.example.com.verify-now.test or to files that install malware. Search results and ads can be seeded so the bait appears first. Torrents and cracked software are common carriers too.
What happens after the click or plug-in depends on the goal. Some bait drops malware that gives remote access or steals data. Some sends the user to a fake sign-in page to harvest passwords. Some opens a support chat that moves the user into a longer scam. In business settings, attackers also use bait to gather small clues. A label, a filename, or a document template can reveal how a company works, which helps later fraud.
Baiting sits alongside other tactics but is not the same as them. It is different from quid pro quo, which is an explicit trade (do this and get that). It is different from pretexting, which leans on a rich story and a fake role. Baiting is lighter. The lure is the message. The victim approaches the attacker, not the other way round. The pattern shows up in many places: fake Wi-Fi hotspots called ‘Free Airport Wi-Fi’, coupon pages, urgent pop-ups, and must-see links in comment threads. The key idea is simple. A planted reward or scare pulls the target into a trap with very little pressure from the attacker.