Adversarial Machine Learning and Prompt Injection in LLM-Driven Phishing Detection: A Systematic Literature Review of Attacks, Defenses, and Open Challenges

As phishing ecosystems evolve from static bulk lures into hyper-personalized, AI-orchestrated campaigns, defensive infrastructure has transitioned toward Pre-trained Language Models (PLMs), Large Language Models (LLMs), and multimodal agents. However, this paradigm shift has triggered a symmetric escalation in adversarial offensive capabilities. This paper presents a comprehensive Systematic Literature Review (SLR) adhering strictly to the PRISMA 2020 protocol, synthesizing n = 60 core primary studies (selected from 376 identified records and 202 quality-scored candidates published between 2020 and 2026) at the intersection of Adversarial Machine Learning (AML), prompt injection, and phishing detection. We formulate and address four Research Questions (RQ1-RQ4). First, we introduce a novel Dual-Axis Offensive Taxonomy categorizing evasion techniques into (i) Discrete and Generative Evasion Perturbations (character-level homoglyphs, cacography, word-level synonym substitution, URL/HTML DOM manipulation, and LLM-automated spear-phishing) and (ii) Cognitive Hijacking via Direct and Indirect Prompt Injection. Second, we systematically map the vulnerability profiles of five defensive paradigms across textual, URL, HTML, and visual modalities, supported by a quantitative meta-synthesis across architectural families. Third, we synthesize five emerging defensive countermeasures, contrasting adversarial training and semantic Graph Attention Networks (GATs) with collaborative Multi-Agent LLM Debate architectures. Finally, we critically audit current benchmark datasets, evaluation metrics, threats to validity, and open challenges, highlighting the urgent need to resolve the multi-agent latency bottleneck, harden agentic email/web scanners against stealthy CSS/DOM-based indirect prompt injection, and establish cross-lingual and Open and Distance e-Learning (ODeL) adversarial benchmarks.