AI-Based Multimodal Phishing Detection Using Large Language Models

Phishing attacks use deceptive emails, messages, URLs, and websites to persuade people to disclose credentials, transfer money, or install malicious software. Conventional detection systems often rely on isolated signals such as suspicious words, URL patterns, or domain reputation. These signals remain useful, but can miss carefully written attacks that combine convincing language, a look-alike website, and a misleading brand identity. This paper presents a literatureinformed conceptual framework for AI-based multimodal phishing detection using large language models (LLMs). The proposed workflow analyzes complementary evidence from message text, URL and domain features, webpage HTML, and page screenshots. Modality-specific components extract structured indicators, while a fusion layer combines evidence into a risk score and an explanation suitable for security analysts or end users. The framework emphasizes calibrated confidence, source provenance, safe handling of untrusted content, human review, and evaluation against realistic baselines. It does not report a newly trained model or original experimental results; instead, it outlines an implementation and evaluation plan. Key challenges include adversarial manipulation, dataset leakage, changing attack patterns, privacy, inference cost, and the risk of incorrect explanations. LLMs can improve contextual interpretation, but should operate alongside reputation checks, conventional classifiers, and security controls rather than replace them.