this post was submitted on 23 Oct 2025
1138 points (99.4% liked)
Programmer Humor
27104 readers
4173 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
A previous (huge) company of mine sent out a lot of phishing test emails, some of which were pretty convincing.
As developers, we quickly discovered that all the emails had a metadata header in them which identified them as a phishing test, so we set up a filter for it so every email since is clearly coded with a bright red "Phishing test!" label.
... You must be one of my co-workers. Except that we just delete ours rather than labeling them.
We needed to label them because the requirement was not only that we don't click them, but that we use the "report phishing" function on them.
Also some of them were pretty funny.
Was it hoxhunt? It's a bit spammy but they seem to push for a more gamefied approach over collective punishment.
Not in my case, no. The content was completely custom to the organisation. I assume they were big enough that they felt like a lot of the risk would come from coordinated spearphishing carefully crafted to look like genuine corp email.
I fucking hate hoxhunt. Just let me send shit to the junk folder and ignore it.
Aren't you supposed to report them though
In my case, the phishing tests originated with the organization that owns my employer, rather than within my employer itself. Our email states are entirely distinct so, while we can report the emails, no one would ever care.
X-Phish
My favorite band from 1999
Where I work they use the microsoft phishing simulation, for which they publish a list of domains they send from.
I have the same thing. All the emails come from nova.phishme.com so I have outlook set to mark them as junk so I can "report" the phishing attempt.
Thanks for the tip!
Assuming that’s disabled -
experienced folks can get caught (e.g. maybe waking up before dawn or something)
Can be a good reminder, a little humbling!
Did it also label real phishing mails?
Because those tests are send out for a reason. And in my experience, developers are some of the worst at cybersecurity.
Honestly, I don't click on anything in Emails. If it is important, somebody will write me in Teams/Slack, and otherwise I just acknowledge and ignore.