CISA lists the main phishing red flags as look alike sender addresses, generic greetings, links that differ from their displayed text, poor formatting and unsolicited attachments paired with urgency. For developers, add one more habit: verify through a separate channel before running anything someone sends you.
The red flags
From CISA's guidance on social engineering and phishing:
- Sender addresses that closely imitate a legitimate organisation.
- Generic greetings and signatures with no contact information.
- Links whose destination differs from the displayed text, or look alike URLs.
- Poor grammar, misspellings or inconsistent formatting.
- Unsolicited attachments, especially with urgency.
CISA also says to treat unsolicited calls, visits or emails asking about staff or internal details with suspicion, and to verify identity directly with the company using contact details from past statements, not from the message.
How developers get targeted differently
Developers are asked to do things that look routine and have high impact: install a package, run a script, review a pull request, join a call, open a take home project. The pretext changes, the structure does not. Someone you have not verified wants you to execute something.
Common shapes:
- A recruiter message with a coding test to clone and run.
- A bug report with a script that reproduces the problem.
- A colleague's account sending a link to a shared document.
- A vendor asking you to approve an app or token for access to your repositories.
Apply the same checks. Is the sender who they claim? Does the link go where it says? Why the urgency?
A response routine
- Stop. Do not click or run it.
- Verify out of band. Message the person on a channel you already trust, or look up the company contact yourself.
- Inspect safely. For code, read it in a browser, not on your laptop. If you must run it, use a disposable VM with no credentials.
- Report. Send it to your security contact even if you did not click. Reports let others spot the same campaign.
If you did click
CISA's advice for victims: report exposed organisational information to the appropriate people, including network administrators, change exposed passwords and use unique ones for each account, and watch for signs of identity theft. For a developer machine, go further:
- Rotate tokens and SSH keys that were on the device. See the lost device checklist for the order.
- Revoke active sessions.
- Ask your security contact to check for new OAuth apps and recent sign ins.
Technical safeguards that help
CISA recommends anti-virus, firewalls, email filters, anti-phishing features in your browser and email client, and multifactor authentication. Phishing resistant MFA is stronger than codes, because a fake site cannot replay a passkey. See how passkeys resist phishing.
Quick check
Should I report a phishing email I did not click?
Yes. It lets your security contact warn others and block the sender.
Sources
Last reviewed: 19 October 2026.
