Aug 2026· Electronics· Vol 15, pp. 3383· 0 citations· 23 references
TL;DR
This study demonstrates how integrating contextual cues and custom lexical signals can significantly improve the detection of AI-generated phishing content and develop sophisticated and resilient defenses against emerging AI-enabled threats.
Abstract
Phishing email attacks remain among the most common and damaging forms of cybercrimes. With the emergence of generative artificial intelligence (Gen-AI), adversaries can automatically generate tailored, well-crafted phishing emails for each potential victim rather than relying on mass-distributed templates, thereby reducing the effectiveness of traditional detection systems. In this study, we propose a novel hybrid framework for detecting AI-generated phishing emails that leverages natural language processing (NLP), machine learning (ML), and deep learning (DL). The uniqueness of the proposed approach lies in the dual application of bidirectional encoder representations from transformers (BERT): (1) as an embedding model to extract deep contextual representations of email content; (2) as a fine-tuned classifier. Additionally, we integrate high-impact common-word features, derived from the best-performing classifier, to enhance contextual interpretation and improve discrimination between human-crafted and AI-generated emails. The framework was evaluated on a balanced dataset combining real and Gen-AI phishing emails and benchmarked across six ML/DL models—support vector machine (SVM), random forest (RF), logistic regression (LR), long short-term memory (LSTM) networks, BERT, and generative pre-trained transformer (GPT)—using standardized preprocessing, hybrid feature engineering, and optimized hyperparameters. Experimental results show that the BERT fine-tuned classifier, enhanced with the integrated common-word features, achieved the highest accuracy of 98%, outperforming all other models and demonstrating strong generalizability. This study demonstrates how integrating contextual cues and custom lexical signals can significantly improve the detection of AI-generated phishing content. Cybersecurity professionals, policymakers, and researchers can develop sophisticated and resilient defenses against emerging AI-enabled threats.
Email phishing is by far one of the most common and harmful cybersecurity risks that make use of misguided communication methods to breach sensitive user data. Phishing attacks keep changing, which greatly constrains the performance of conventional rule-based and classical machine-learning methods of detection. The proposed study will introduce a hybrid deep learning model that combines Convolutional Neural Networks (CNN) and Bidirectional Long Short-term Memory (Bi-LSTM) networks to detect emails with high phishing accuracy. The model proposed examines various elements of email, such as, email headers, subject lines, message bodies and embedded URLs, in the form of a rich feature representation that represents structural and contextual features. The datasets collected in the real world, PhishTank and Mendeley repositories, were preprocessed by feature binning, redundancy reduction as well as class balancing to improve the quality of data and generalization. The experimental findings indicate that CNNBILSTM model has a high accuracy (96), precision (95.9), recall (96) and ROC-AUC (0.99), which is better than a number of baseline models, including Support Vector Machines (SVM), Decision Trees, K-Nearest Neighbors (KNN) and individual neural networks. The statistical analysis also verifies that the performance improvements are substantial (p < 0.05) and the confidence intervals are not wide which means the study is very consistent and reliable. Based on the findings, it is possible to note that the CNN-BiLSTM model represents a reliable, scalable, and high-performance solution that can be applied to real-time email phishing detection in the contemporary cybersecurity settings.
Nicholas Muriuki· Journal of Intelligent Syste...· 0 citations
Phishing remains a prevalent cyberattack vector, and the widespread adoption of large language models (LLMs) has enabled adversaries to generate grammatically correct and contextually coherent phishing emails at scale, against which conventional detection systems are less effective. Although stylometric methods achieve over 95% accuracy within a single generator, their performance has not been systematically evaluated when the source model changes between training and deployment. This represents a significant gap, as adversaries can switch generators rapidly. A balanced corpus of 9,986 phishing emails was assembled, comprising 4,986 emails generated by three modern LLMs (GPT-4.1, DeepSeek 3.2, and Llama 3.3 70B) across five thematic categories, and 5,000 human phishing emails sampled in a stratified manner from five public sources. Seventeen stylometric features were extracted, and Logistic Regression and XGBoost classifiers were evaluated under intra-model, cross-model, threshold-recalibrated, cross-dataset, and aggregated-pool settings. Intra-model F1 scores reached 0.96 under stratified cross-validation and 0.999 on held-out splits used for the cross-model matrix. However, cross-model F1 dropped by 28.0 percentage points under the default decision threshold of 0.5. Notably, the area under the receiver operating characteristic curve remained above 0.96 in every off-diagonal cell, indicating that discriminative information is preserved even though the decision threshold is generator-specific. Recalibrating the threshold on a small target subset reduced the gap to 4.0 percentage points (an 86% reduction), and an aggregated-pool detector achieved F1 = 0.997 on each generator. This work reframes cross-model phishing detection from a problem of model incompatibility to one of practical calibration, and provides two deployable solutions, threshold recalibration on a small target slice and aggregated-pool training, along with a publicly released multi-LLM corpus.
Rommel Gutierrez, W. Villegas-Ch., Jaime Govea· Frontiers in Big Data· 0 citations
An Explainable Ensemble Artificial Intelligence Framework for Real Time Phishing Website Detection that addresses the primary weakness of existing systems and is deployed as a real-time desktop application.
F. J. Boniface· International Journal of Com...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
PhishingGAT, a detector that fuses word-level semantic features with structural ones and is hardened against adversarial perturbation, is presented, a detector that fuses word-level semantic features with structural ones and is hardened against adversarial perturbation.
R. Kodali, Siva Rama Krishna T Dr· International Journal of Inn...· 0 citations
Phishing attacks continue to evolve in sophistication, making them one of the most significant cybersecurity threats affecting individuals and organizations. Traditional phishing detection techniques based on rule-based systems and standalone machine learning algorithms often struggle to identify modern phishing emails generated using artificial intelligence and advanced social engineering techniques. This study proposes an AI-driven hybrid ensemble model that integrates Support Vector Machine (SVM), Random Forest (RF), and Bidirectional Long Short-Term Memory (Bi-LSTM) to improve phishing email detection accuracy and robustness. To address dataset imbalance and the limited availability of AI-generated phishing emails, an AI-based data augmentation module was incorporated to generate realistic synthetic phishing samples during model training. The proposed methodology consists of data collection, preprocessing, feature engineering, synthetic data generation, individual model training, and ensemble classification using a soft voting mechanism. Experimental evaluation was performed using benchmark phishing email datasets and standard performance metrics, including accuracy, precision, recall, F1-score, confusion matrix, and inference latency. Results indicate that the proposed hybrid model achieved an overall detection accuracy of 98.9%, outperforming a comparable existing model, which achieved 95.2% accuracy. Furthermore, the hybrid approach demonstrated improved generalization, reduced false classifications, and faster detection latency. The findings suggest that combining classical machine learning, deep learning, and AI-driven data augmentation provides an effective framework for protecting modern email systems against both conventional and AI-generated phishing attacks.
Chikeru Ihunwo, V. Emmah, N. Nwiabu· International Journal of Res...· 0 citations