Beyond Isolated Phishing Emails: Discovering Hidden Campaign Relationships with MCDA

Detecting phishing URLs with self-organizing models

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats

PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research

Phishing websites are short-lived and rapidly changing, yet many phishing datasets reduce observations to URLs or precomputed features, constraining researchers to predefined representations and discarding the underlying evidence needed to derive alternative features, apply new extraction methods, examine cross-layer relationships, and reanalyze observations as phishing techniques evolve. This study addresses this limitation with a multi-layer active-web dataset comprising 67,502 scans, including 33,387 phishing observations from operational feeds and 34,115 screened benign reference observations. The corpus preserves raw evidence across HTML content and screenshots, URL and redirect behavior, HTTP and security headers, compliance files, TLS certificates, DNS and domain registration, open ports, geolocation and accessibility measurements, and network infrastructure, while explicitly recording unavailable evidence rather than treating it as negative observations. To avoid misleading infrastructure attribution on shared platforms, the study applies a hosting-aware evidence model that masks provider-owned infrastructure signals for free-hosted tenant pages while retaining meaningful page- and transport-level evidence. Characterization reveals systematic differences between phishing and benign websites across web-resource usage, domain maturity, mail and policy configuration, security headers, and infrastructure context. By preserving raw artifacts together with acquisition metadata and explicit evidence availability, the corpus provides an inspectable and reproducible foundation for future phishing measurement and dataset research.

Fine-Tuning LLMs for Operational Phishing Email Detection

: Phishing email attacks, a predominant and evolving cyber threat, necessitate detection systems that are not only accurate but also robust, efficient, trustworthy, and explainable. While Large Language Models (LLMs) offer transformative potential for semantic analysis in many areas, their practical deployment for phishing detection requires a holistic assessment beyond peak accuracy. This paper presents an operational phishing detection system that processes raw emails using a LLM and provides understandable explanations. We compared three fine-tuned LLMs among CamemBERT-base, XLM-RoBERTa, and Mistral 7B and we evaluate their performance, generalization capabilities, computational efficiency, and explainability on multiple significant datasets. Our results demonstrate that LLMs significantly outperform character-level models, with XLM-RoBERTa and Mistral 7B achieving over 99.4% accuracy. Critically, we reveal a fundamental trade-off: while Mistral 7B achieves marginally higher accuracy, its computational cost could be prohibitive for real-time deployment. In contrast, XLM-RoBERTa provides an optimal balance, offering state-of-the-art accuracy (99.46%), superior cross-dataset generalization (95.76% on an unseen corpus), and practical inference speed. Furthermore, by integrating SHAP-based explainability with a generative LLM, we validate that model decisions align with recognizable phishing indicators, bridging the gap between high performance and operational trust. This work provides a multi-dimensional framework for evaluating phishing detection systems and demonstrates that for most real-world applications, a multilingual, efficient encoder like XLM-RoBERTa represents the most viable and trustworthy choice.

Cross-model evaluation of phishing detectors against LLM-generated emails

Phishing remains a prevalent cyberattack vector, and the widespread adoption of large language models (LLMs) has enabled adversaries to generate grammatically correct and contextually coherent phishing emails at scale, against which conventional detection systems are less effective. Although stylometric methods achieve over 95% accuracy within a single generator, their performance has not been systematically evaluated when the source model changes between training and deployment. This represents a significant gap, as adversaries can switch generators rapidly. A balanced corpus of 9,986 phishing emails was assembled, comprising 4,986 emails generated by three modern LLMs (GPT-4.1, DeepSeek 3.2, and Llama 3.3 70B) across five thematic categories, and 5,000 human phishing emails sampled in a stratified manner from five public sources. Seventeen stylometric features were extracted, and Logistic Regression and XGBoost classifiers were evaluated under intra-model, cross-model, threshold-recalibrated, cross-dataset, and aggregated-pool settings. Intra-model F1 scores reached 0.96 under stratified cross-validation and 0.999 on held-out splits used for the cross-model matrix. However, cross-model F1 dropped by 28.0 percentage points under the default decision threshold of 0.5. Notably, the area under the receiver operating characteristic curve remained above 0.96 in every off-diagonal cell, indicating that discriminative information is preserved even though the decision threshold is generator-specific. Recalibrating the threshold on a small target subset reduced the gap to 4.0 percentage points (an 86% reduction), and an aggregated-pool detector achieved F1 = 0.997 on each generator. This work reframes cross-model phishing detection from a problem of model incompatibility to one of practical calibration, and provides two deployable solutions, threshold recalibration on a small target slice and aggregated-pool training, along with a publicly released multi-LLM corpus.

Phishing GAT: Adversarial-Hardened Phishing Email Detection via Semantic-Structural Fusion and Graph Attention Networks

Phishing email detection has been destabilised by Large Language Models (LLMs), which allow attackers to mass-produce fluent, contextually plausible messages. Detectors tuned on legacy corpora, notably the 2008 CEAS spam collection, consequently report benchmark accuracies that do not survive deployment. We present PhishingGAT, a detector that fuses word-level semantic features with structural ones and is hardened against adversarial perturbation. Each email is represented as an undirected graph whose nodes are unique tokens carrying 100-dimensional GloVe embeddings, and whose edges record co- occurrence inside a three-token sliding window. A two-layer Graph Attention Network (GAT) then learns per-edge importance over that graph. Robustness comes from Projected Gradient Descent (PGD) adversarial training, applied to continuous node features during optimisation only. Training uses a hybrid corpus of 70,716 emails assembled from the CEAS collection, the Enron collection, and curated LLM-generated samples. Evaluation follows two protocols. The first is strictly zero-shot: 1,186 unseen LLM-generated adversarial emails, on which the model reaches 77.40 per cent accuracy and an area under the receiver operating characteristic curve (AUC) of 0.8700. The second is domain-adapted: 401 held-out hard samples, on which accuracy rises to 90.27 per cent and AUC to 0.9717. The 12.87 percentage-point difference between the two is, to our knowledge, the first such measurement reported for graph-based phishing detection, and it quantifies a degradation that same-distribution benchmarks systematically hide. An ablation separates the contribution of attention from that of adversarial defence, and repeated runs across independent random seeds confirm that the reported figures are reproducible rather than seed artefacts.