I clicked a phishing link: what an engineer should do in order

Report it immediately, then act on what you did. If you only clicked, scan the device. If you typed credentials, change the password and revoke sessions. If you approved an app, revoke it. Engineers should also rotate any tokens and review repositories and mail rules.

First two minutes

Tell your security contact now, even if you are unsure. Speed beats embarrassment. Do not delete the message, since the header and link help investigators. Use your mail client's report option where available, as CISA advises.

Match the action to what happened

You only clicked a link. The FTC advises updating security software, running a scan and removing anything found if you clicked a link or opened an attachment that may have installed harmful software. Disconnect from the network if your policy says so.

You entered a password. Change it from a clean device, and do not reuse it anywhere. Revoke active sessions, because a proxy page may have captured a session as well. Check MFA methods for any you did not add. See AiTM phishing.

You entered an MFA code or approved a prompt. Treat it as a full account takeover. Follow the mailbox response checklist.

You authorized an app. Revoke it. On GitHub, go to Settings, Applications, Authorized OAuth Apps, and revoke the unknown app. Reports of a 2025 GitHub campaign advise also changing credentials, rotating authorization tokens, and reviewing repositories for unauthorized additions. See consent phishing.

Engineer extras

1. Rotate personal access tokens, SSH keys and API keys that were reachable from the account or machine.
2. Check recent commits, workflow files, deploy keys and new webhooks for changes you did not make.
3. Review cloud console sign-in history and any new access keys.
4. Look at mailbox inbox rules and forwarding.
5. Tell finance if any payment thread was touched.

For the security team

Collect the message, the URL and the time. Block the domain. Search mail logs for other recipients. Record the timeline.

If personal or financial data was exposed, the FTC points people to IdentityTheft.gov for steps based on what was lost. For phishing reports the FTC lists reportphishing@apwg.org for email and 7726 for texts.

Do not

• Do not wait to see whether anything happens.
• Do not log in again on the suspicious page to test it.
• Do not reuse the same password after changing it.

Afterwards

Run a short blameless review. Ask what made the message convincing, which control would have limited the damage, and whether the reporting path felt easy. If the person who clicked reported within minutes, say thank you publicly. People report quickly only when they expect the response to be calm.

Quick check

Sources

• CISA: Recognize and report phishing
• FTC: How to recognize and avoid phishing scams
• Reviewing your authorized OAuth apps (GitHub Docs)
• GitHub project maintainers targeted with fake security alert (Help Net Security)

Last reviewed: 19 October 2026.