Which of the following security threats includes suspicious activity, such as reviewing someone's screen display without permission?

A (Malware) is malicious software designed to disrupt, damage, or gain unauthorized access to a computer system, not direct observation.

B (Shoulder surfing) is a social engineering technique where an attacker directly observes a person's screen or keyboard input, typically from an angle over their shoulder, to steal sensitive information like passwords, PINs, or confidential data. This method relies on physical proximity and direct observation.

C (Phishing) is a social engineering attack that tricks individuals into revealing sensitive information through deceptive electronic communications, not direct physical observation.

D (Password cracking) involves attempting to discover a password by systematically trying combinations or dictionary words, typically through automated software, not by watching a person's screen.