Baiting today: the bait isn't a USB drive anymore, it's you running the command

Baiting is the branch of social engineering that doesn't trick you about who's talking, but about what you're about to use. The textbook example was the USB drive abandoned in a parking lot: someone finds it, plugs it in out of curiosity, and the malware walks in through the door the victim opened herself.

That example still works as an illustration, but it stopped being the common case a while ago. It requires physical presence, it doesn't scale, and USB lockdown policies on corporate machines took away most of its ground.

The bait moved to where people are, and in the process it got considerably more effective.

Today's dominant bait: "verify you're human"

The technique is known as ClickFix, and its design is notably clever: instead of getting you to download and open a file, it convinces you to carry out the attack with your own hands.

The typical script:

1. You land on a page — from an ad, a search result, a compromised site, or a link on social media.
2. Something that looks like a routine check appears: a CAPTCHA, a "your browser needs an update" notice, a video playback error.
3. The instructions ask for a couple of manual steps: press Win + R, paste what's already on your clipboard, press Enter. On macOS, open Terminal and paste.
4. What you pasted isn't a verification. It's a command that downloads and runs malware.

What ends up installed is usually an infostealer: software that collects credentials saved in the browser, session cookies, cryptocurrency wallets and VPN configurations, and sends them out.

The technique has scaled enough that it stopped being a Windows-only problem: in May 2026 Microsoft documented ClickFix campaigns targeting macOS, disguised as system utilities and using Terminal instead of the Run dialog. In June 2026 the US FTC published a consumer alert about the same pattern.

And what makes it hard to stop is that the wrapper changes every few months — a CAPTCHA today, a printer error tomorrow, an Office "repair" step after that — while the mechanics stay identical: a screen convinces the user that the fix is to paste something into a system window.

The other bait: the software you searched for yourself

The second variant takes advantage of the fact that most people install programs by searching for them in a search engine.

• Fake sponsored results. The attacker pays for ads on terms like the name of a PDF reader, a VPN client, or a popular AI tool. The ad appears above the real result, the site is a convincing copy, and the installer works — it just carries extra payload.
• AI tool installers. Every time a tool gets popular fast, "desktop clients" and "free versions" nobody actually published show up.
• Cracked software. The oldest bait still paying off: what's offered for free is exactly what people don't report when something goes wrong.

The common pattern is that the victim started the search. There was no suspicious email and no sender to verify: there was a real need and a result that seemed to answer it.

What sets baiting apart from other attacks

Dimension	Phishing	Vishing	Baiting
What gets faked	A sender	A voice	A useful resource or object
Who initiates	The attacker	The attacker	Often, the victim
What it exploits	Trust in an identity	Trust in a person	Curiosity or a concrete need
What it asks of the victim	A click or a credential	An urgent action	Running or installing something

That third column is why baiting resists classic training. Training teaches people to distrust what arrives unrequested; baiting arrives while someone is trying to solve something.

What works

The one-sentence rule

It's worth more than any checklist: no legitimate website is ever going to ask you to paste a command into a system window to prove you're human. None. A real CAPTCHA gets solved inside the page.

If your team takes away exactly one thing on this topic, make it that.

Install only from the source

For software, go to the official site by typing the domain, or use the system's app store — not the first result, and definitely not the sponsored one. For a company, the cleanest approach is a short list of approved software with the download link already set, so nobody has to search for it.

Devalue what the infostealer takes

If the target is browser credentials and session cookies, then:

• Use a password manager instead of the browser's built-in storage.
• Sessions that expire, so a stolen cookie goes stale.
• Passkeys wherever possible: a credential bound to a domain can't be reused from the attacker's machine.

Control USB access without overdoing it

The USB drive is still a vector, especially in environments with shared machines or third-party access. Blocking autorun and restricting storage devices on corporate machines covers the case, and doesn't need more discussion than that.

Let the team report at no cost

Someone who pasted the command and realized late needs to be able to say so immediately. An infostealer caught the same day allows credentials to be rotated and sessions revoked; one discovered when a strange login shows up has already had weeks to work.

In short

Baiting stopped depending on someone finding an object and started depending on someone following instructions. That's an uncomfortable shift, because it turns the user into the one executing the attack and leaves little to block technically. The countermeasure is just as concrete: make sure everyone knows pasting commands is never part of a verification, and that installing software has exactly one approved path.

---

This article was originally published in May 2024 and rewritten in September 2026, once the usual bait was no longer a physical device but a screen asking you to run a command.

Let's talk about your company's security