PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants

arXiv:2507.15393 · cs.CR, cs.AI · Submitted 2025-07-21 · Read on arXiv

cs.CR, cs.AI

Submitted: 2025-07-21

Updated: 2026-09-07

Code: https://github.com/code-philia/PhishEmail

Project page: https://sites.google.com/view/pimref/home

License: http://creativecommons.org/licenses/by/4.0/

The gist: Phishing email is a critical step in the cybercrime kill chain due to the high reachability of victims' email accounts and the low cost of launching phishing campaigns.

Terminology

Abstract

Phishing email is a critical step in the cybercrime kill chain due to the high reachability of victims' email accounts and the low cost of launching phishing campaigns. This ever-evolving nature of phishing emails makes traditional rule-based and feature-engineering-based phishing email detectors fight an uphill battle in the cat-and-mouse game of defense and attack. In this work, we show that, large language models (LLMs) can be effectively exploited to generate profile-grounded spear-phishing, compromising major paradigms of phishing email detectors. To defend against such LLM-based spear-phishing attacks, we propose PiMRef, the first reference-based solution to detect ever-evolving phishing emails using knowledge-based invariants, targeting the identity-impersonation attacks that characterize spear-phishing. Our rationale lies in the fact that convincing phishing emails often include ``disprovable claims'', which contradict certain real-world facts. Technically, given an email, PiMRef (i) discovers the claimed identity of the sender, (ii) verifies the sender's email domain against a dynamically expandable knowledge base, and (iii) infers call-to-action instructions that encourage next-step engagement. Compared to existing baselines such as D-Fence, HelpHed, and ChatSpamDetector, PimRef reduces the false-positive rate to 0.81% while maintaining a recall of 90.7%-93.1% on conventional phishing benchmarks such as Nazario and PhishPot. On SpearMail, our newly constructed benchmark of 14,672 LLM-generated spear-phishing emails targeting 681 public profiles, PimRef reaches a recall of 86.4% without incurring additional false positives. Our code is publicly available at https://github.com/code-philia/PhishEmail.

Sources

Related papers