Phishing red flags in the AI era: myth versus fact

Bad spelling is no longer a reliable sign of phishing. CISA says some phishing emails now have perfect grammar and spelling because of AI. Reliable signs are pressure to act fast, requests for sensitive data, links or addresses that do not match, and any ask that bypasses your normal process.

Myth: phishing emails are full of typos

Fact: CISA's guidance lists urgent or emotional language, requests for personal or financial information, untrusted shortened URLs and incorrect email addresses or links as signs, and adds that some emails will now have perfect grammar and spelling. Training that says "look for mistakes" leaves people exposed to the clean ones.

Myth: if it came through a trusted service it is safe

Fact: attackers can abuse trusted channels. In a 2025 campaign reported by Help Net Security, fake security alerts were created as GitHub issues so that GitHub's own notification emails delivered them. Judge the request, not just the sender. See the fake GitHub alert.

Myth: MFA makes phishing harmless

Fact: MFA helps a great deal, but a proxy phishing page can relay the sign-in and steal the session. Microsoft describes this and recommends phish-resistant methods. See AiTM phishing.

Myth: only executives and finance get targeted

Fact: developers hold tokens, repo access and cloud consoles. The OAuth app in the GitHub case could reach repositories and modify workflow files, according to the report.

Fact: the safest habit is verifying out of band

CISA's recommended steps are to resist, delete and verify. If a message might be real, do not click its links or call its numbers. Contact the company through its verified website, or the person through a different method you already trust. The FTC gives the same advice.

Signs that still hold up

• Unexpected request: Real work usually follows a known channel
• Pressure and secrecy: Attackers need you to skip checks
• Request to log in via a link: Go to the site yourself instead
• Permission prompt that does not fit: An app that secures an account should not edit workflows
• Payment or credential change: Always verify separately

A practical habit for engineers

Pause on any message that asks for a login, a token, an approval or an app authorization. Ask: did I start this? If not, go to the service directly. Report the message using your mail client's report button, as CISA advises. See the reporting process.

Quick check

Sources

• CISA: Recognize and report phishing
• FTC: How to recognize and avoid phishing scams
• GitHub project maintainers targeted with fake security alert (Help Net Security)
• From cookie theft to BEC (Microsoft Security blog)

Last reviewed: 19 October 2026.