{"id":"https://openalex.org/W7139983363","doi":"https://doi.org/10.1016/j.array.2026.100775","title":"A systematic literature review of large language models in phishing attack generation and detection","display_name":"A systematic literature review of large language models in phishing attack generation and detection","publication_year":2026,"publication_date":"2026-03-21","ids":{"openalex":"https://openalex.org/W7139983363","doi":"https://doi.org/10.1016/j.array.2026.100775"},"language":"en","primary_location":{"id":"doi:10.1016/j.array.2026.100775","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.array.2026.100775","pdf_url":null,"source":{"id":"https://openalex.org/S4210194039","display_name":"Array","issn_l":"2590-0056","issn":["2590-0056"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Array","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1016/j.array.2026.100775","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5123774334","display_name":"Dinushan Sivaneswaran","orcid":null},"institutions":[{"id":"https://openalex.org/I55060895","display_name":"University of Greenwich","ror":"https://ror.org/00bmj0a71","country_code":"GB","type":"education","lineage":["https://openalex.org/I55060895"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Dinushan Sivaneswaran","raw_affiliation_strings":["School of Computing and Mathematical Sciences, University of Greenwich, London, UK"],"raw_orcid":"https://orcid.org/0009-0001-9103-8578","affiliations":[{"raw_affiliation_string":"School of Computing and Mathematical Sciences, University of Greenwich, London, UK","institution_ids":["https://openalex.org/I55060895"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123755382","display_name":"Chaminda T.E.R. Hewage","orcid":null},"institutions":[{"id":"https://openalex.org/I8408910","display_name":"Cardiff Metropolitan University","ror":"https://ror.org/00bqvf857","country_code":"GB","type":"education","lineage":["https://openalex.org/I8408910"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Chaminda T.E.R. Hewage","raw_affiliation_strings":["Cybersecurity and Information Networks Centre (CINC), Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK"],"raw_orcid":"https://orcid.org/0000-0001-7593-6661","affiliations":[{"raw_affiliation_string":"Cybersecurity and Information Networks Centre (CINC), Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK","institution_ids":["https://openalex.org/I8408910"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130254547","display_name":"H.M.K.K.M.B. Herath","orcid":null},"institutions":[{"id":"https://openalex.org/I8991828","display_name":"Pukyong National University","ror":"https://ror.org/0433kqc49","country_code":"KR","type":"education","lineage":["https://openalex.org/I8991828"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"H.M.K.K.M.B. Herath","raw_affiliation_strings":["Industry 4.0 Convergence Bionics Engineering, Pukyong National University, Busan, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-1873-768X","affiliations":[{"raw_affiliation_string":"Industry 4.0 Convergence Bionics Engineering, Pukyong National University, Busan, Republic of Korea","institution_ids":["https://openalex.org/I8991828"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130284712","display_name":"Rajkumar Singh Rathore","orcid":null},"institutions":[{"id":"https://openalex.org/I8408910","display_name":"Cardiff Metropolitan University","ror":"https://ror.org/00bqvf857","country_code":"GB","type":"education","lineage":["https://openalex.org/I8408910"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Rajkumar Singh Rathore","raw_affiliation_strings":["Cybersecurity and Information Networks Centre (CINC), Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK"],"raw_orcid":"https://orcid.org/0000-0003-4571-1888","affiliations":[{"raw_affiliation_string":"Cybersecurity and Information Networks Centre (CINC), Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK","institution_ids":["https://openalex.org/I8408910"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091495389","display_name":"Vishal Krishna Singh","orcid":"https://orcid.org/0000-0002-5438-579X"},"institutions":[{"id":"https://openalex.org/I110002522","display_name":"University of Essex","ror":"https://ror.org/02nkf1q06","country_code":"GB","type":"education","lineage":["https://openalex.org/I110002522"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Vishal Krishna Singh","raw_affiliation_strings":["School of Computer Science and Electronics Engineering, University of Essex, Colchester, UK"],"raw_orcid":"https://orcid.org/0000-0002-5438-579X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Electronics Engineering, University of Essex, Colchester, UK","institution_ids":["https://openalex.org/I110002522"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130292340","display_name":"Weiwei Jiang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiwei Jiang","raw_affiliation_strings":["School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"raw_orcid":"https://orcid.org/0000-0003-0953-5047","affiliations":[{"raw_affiliation_string":"School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5091495389","https://openalex.org/A5123755382","https://openalex.org/A5123774334"],"corresponding_institution_ids":["https://openalex.org/I110002522","https://openalex.org/I55060895","https://openalex.org/I8408910"],"apc_list":{"value":1350,"currency":"USD","value_usd":1350},"apc_paid":{"value":1350,"currency":"USD","value_usd":1350},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.66279117,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"30","issue":null,"first_page":"100775","last_page":"100775"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9815999865531921,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9815999865531921,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.004699999932199717,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0027000000700354576,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.8921999931335449},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.40070000290870667},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.35989999771118164},{"id":"https://openalex.org/keywords/social-media","display_name":"Social media","score":0.3086000084877014}],"concepts":[{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.8921999931335449},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5105999708175659},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4887000024318695},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.40070000290870667},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3765000104904175},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.35989999771118164},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.3086000084877014},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.29600000381469727},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29030001163482666},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.28439998626708984},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.array.2026.100775","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.array.2026.100775","pdf_url":null,"source":{"id":"https://openalex.org/S4210194039","display_name":"Array","issn_l":"2590-0056","issn":["2590-0056"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Array","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.array.2026.100775","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.array.2026.100775","pdf_url":null,"source":{"id":"https://openalex.org/S4210194039","display_name":"Array","issn_l":"2590-0056","issn":["2590-0056"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Array","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4283008575439453,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W3133843004","https://openalex.org/W3196390350","https://openalex.org/W4378418074","https://openalex.org/W4385452929","https://openalex.org/W4391592188","https://openalex.org/W4392667162","https://openalex.org/W4392745485","https://openalex.org/W4400067427","https://openalex.org/W4400914028","https://openalex.org/W4401004521","https://openalex.org/W4401426188","https://openalex.org/W4401946900","https://openalex.org/W4403600666","https://openalex.org/W4404356490","https://openalex.org/W4404688214","https://openalex.org/W4404731747","https://openalex.org/W4404801206","https://openalex.org/W4405752094","https://openalex.org/W4405760810","https://openalex.org/W4405915372","https://openalex.org/W4406302454","https://openalex.org/W4407449623","https://openalex.org/W4407848008","https://openalex.org/W4408941302"],"related_works":[],"abstract_inverted_index":{"Phishing":[0,244],"attacks":[1,48,270],"continue":[2],"to":[3,28,239,276],"grow":[4],"in":[5,19,45,205,243,283],"scale":[6],"and":[7,13,31,49,64,67,86,90,102,124,153,156,167,185,200,221,230,247,256,263],"sophistication,":[8],"causing":[9],"substantial":[10],"financial":[11],"losses":[12],"privacy":[14],"breaches":[15],"worldwide.":[16],"Recent":[17],"advances":[18],"large":[20],"language":[21],"models":[22,127],"(LLMs)":[23],"have":[24,219,254],"brought":[25],"significant":[26],"changes":[27],"the":[29,40,53,103,143,162,214,227,273,277],"generation":[30,144,246],"detection":[32],"of":[33,43,84,95,145,183,280],"phishing":[34,47,146,189,269],"content.":[35,158],"This":[36,159],"study":[37,238,251],"systematically":[38],"investigates":[39],"dual":[41],"role":[42],"LLMs":[44,140,173,218,241,253],"facilitating":[46],"strengthening":[50],"countermeasures.":[51],"Using":[52],"PRISMA":[54],"methodology,":[55],"authors":[56],"screened":[57],"142":[58],"records":[59],"published":[60],"between":[61],"January":[62],"2023":[63],"April":[65],"2025":[66],"identified":[68],"36":[69],"eligible":[70],"studies":[71,112],"from":[72],"major":[73],"academic":[74],"databases,":[75],"including":[76],"IEEE":[77],"Xplore,":[78],"ScienceDirect,":[79],"ACM":[80],"Digital":[81],"Library,":[82],"Web":[83],"Science,":[85],"Scopus.":[87],"A":[88],"comprehensive":[89],"rigorous":[91],"analysis":[92,182],"was":[93],"conducted":[94],"research":[96],"trends/themes":[97],"over":[98],"time,":[99],"dataset":[100],"characteristics,":[101],"LLM":[104,134],"architectures/models":[105],"employed.":[106],"The":[107,136,235,250],"findings":[108,215],"reveal":[109],"that":[110,125,139,217],"most":[111],"relied":[113],"on":[114,272],"manually":[115],"generated":[116],"datasets":[117],"rather":[118],"than":[119,132],"publicly":[120],"available":[121],"benchmark":[122],"datasets,":[123],"GPT-based":[126],"received":[128],"considerably":[129],"more":[130,180],"attention":[131],"other":[133],"architectures.":[135],"review":[137,240],"demonstrates":[138],"substantially":[141],"enhance":[142],"content":[147,187],"by":[148,178],"producing":[149],"coherent,":[150],"contextually":[151],"relevant,":[152],"persuasive":[154],"email":[155],"website":[157],"capability":[160],"lowers":[161],"technical":[163],"barrier":[164],"for":[165,188],"attackers":[166],"potentially":[168],"increases":[169],"attack":[170,245],"effectiveness.":[171],"Conversely,":[172],"also":[174],"strengthen":[175],"defensive":[176,232],"strategies":[177],"enabling":[179],"effective":[181],"textual":[184],"visual":[186],"detection.":[190,248],"In":[191],"many":[192],"cases,":[193],"LLM-based":[194],"approaches":[195],"outperform":[196],"traditional":[197],"machine":[198],"learning":[199,202],"deep":[201],"methods":[203],"and,":[204],"certain":[206],"contexts,":[207],"approach":[208],"or":[209],"match":[210],"human-level":[211],"performance.":[212],"Overall,":[213],"suggest":[216],"accelerated":[220,255],"automated":[222,257],"phishing-related":[223,258],"processes,":[224,259],"simultaneously":[225],"intensifying":[226],"threat":[228],"landscape":[229],"advancing":[231],"capabilities.":[233],"\u2022":[234,249,266],"first":[236],"in-depth":[237],"usage":[242],"reveals":[252],"elevating":[260],"both":[261],"threats":[262],"defence":[264],"mechanisms.":[265],"GenAI-based":[267],"multimodal":[268],"are":[271],"rise":[274],"due":[275],"wider":[278],"adoption":[279],"GenAI":[281],"tools":[282],"general.":[284]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2026-03-22T00:00:00"}