Physical USB drop / Baiting

An adversary may leave or distribute removable media as bait and rely on a user to open a malicious file, leading to code execution. The user-opening behavior maps to ATT&CK T1204.002; copying malware to or between removable media is separately described by T1091. USB insertion alone does not imply execution: AutoRun behavior depends on media compatibility and system policy, and user interaction may be required.