ITPEC FE Subject A October 2025 Question 27

Baiting attack — social engineering attack using a physical lure (e.g., infected USB drive) to trick victims into compromising their systems.

The attacker left a malware-loaded USB stick labeled with an enticing title in front of an office, hoping someone would plug it in out of curiosity. This is baiting — using a physical object as a trap.

Why not others:
- (b) Identity theft — stealing someone's personal information to impersonate them; this is a consequence, not an attack method
- (c) Phishing — tricking victims via fraudulent emails or websites; no electronic communication is involved here
- (d) Pretexting — creating a fabricated scenario (e.g., posing as IT support) to extract information through conversation; no personal interaction occurs here

Key rule: physical lure left for the victim to find = baiting; deceptive email/website = phishing; fabricated story in direct communication = pretexting.

AI-generated — may contain errors