In short Tricking someone into revealing keys or signing a malicious transaction, usually through a fake website or message.
Typical bait: a fake airdrop, an urgent "security alert", or a search ad imitating a real site. Bookmark the sites you use and never enter a seed phrase online.