A lure is the deceptive message, attachment, or file used to trigger a victim’s next action in a phishing or malware campaign. It may look like a tax form, invoice, delivery notice, password alert, or shared document. The goal is not to exploit software directly, but to exploit attention, urgency, and trust so the target clicks, opens, or installs something harmful.
Lures matter because they are often the first step in access. A successful lure can lead to credential theft, malware execution, or the installation of legitimate remote-access software that attackers abuse for hands-on control. Defenders look for mismatches between the message and the expected workflow, unexpected attachments, and out-of-band software installs. Training users, filtering suspicious mail, and alerting on unusual file types or unauthorized remote tools all help reduce the risk created by a convincing lure.