The Rise of Sophisticated Phishing Attacks: Detection, Prevention, and Future Directions

Abstract

Phishing has evolved from crude, error-prone mass email campaigns into a highly sophisticated class of multi-channel social-engineering attacks that exploit artificial intelligence, real-time session hijacking, and highly convincing brand impersonation. Traditional defence mechanisms, including blacklists, simple URL heuristics, and signature-based filters, are no longer sufficient to counter this rapidly expanding threat landscape. This review synthesizes recent literature on sophisticated phishing attacks and makes four primary contributions. First, it presents a systematized taxonomy of modern phishing attack vectors, encompassing email, SMS, voice, QR code, business email compromise (BEC), and adversary-in-the-middle (AiTM) techniques. Second, it provides a critical and comparative review of detection approaches spanning rule-based methods, classical machine-learning algorithms, deep-learning models, transformer-based architectures, visual analysis techniques, and behavioural detection methods, highlighting their reported strengths, limitations, and levels of operational maturity. Third, it proposes a conceptual four-layer hybrid detection framework that integrates lexical URL analysis, HTML and visual content inspection, transformer-based semantic understanding, and behavioural session analytics through a stacked meta-learner to improve detection accuracy and robustness. Finally, the review discusses current prevention strategies, including FIDO2 phishing-resistant authentication, DMARC enforcement, and human-centric security awareness training, while identifying key research directions such as LLM-driven adversarial phishing, deepfake voice attacks, privacy-preserving detection, explainable artificial intelligence, and resilient security workflows for next-generation phishing defence.