Hybrid AI-Based Detection of LLM-Generated Phishing Emails

Abstract

Phishing email attacks remain among the most common and damaging forms of cybercrimes. With the emergence of generative artificial intelligence (Gen-AI), adversaries can automatically generate tailored, well-crafted phishing emails for each potential victim rather than relying on mass-distributed templates, thereby reducing the effectiveness of traditional detection systems. In this study, we propose a novel hybrid framework for detecting AI-generated phishing emails that leverages natural language processing (NLP), machine learning (ML), and deep learning (DL). The uniqueness of the proposed approach lies in the dual application of bidirectional encoder representations from transformers (BERT): (1) as an embedding model to extract deep contextual representations of email content; (2) as a fine-tuned classifier. Additionally, we integrate high-impact common-word features, derived from the best-performing classifier, to enhance contextual interpretation and improve discrimination between human-crafted and AI-generated emails. The framework was evaluated on a balanced dataset combining real and Gen-AI phishing emails and benchmarked across six ML/DL models—support vector machine (SVM), random forest (RF), logistic regression (LR), long short-term memory (LSTM) networks, BERT, and generative pre-trained transformer (GPT)—using standardized preprocessing, hybrid feature engineering, and optimized hyperparameters. Experimental results show that the BERT fine-tuned classifier, enhanced with the integrated common-word features, achieved the highest accuracy of 98%, outperforming all other models and demonstrating strong generalizability. This study demonstrates how integrating contextual cues and custom lexical signals can significantly improve the detection of AI-generated phishing content. Cybersecurity professionals, policymakers, and researchers can develop sophisticated and resilient defenses against emerging AI-enabled threats.