Multimodal Analysis of Modern Phishing Attacks: Towards an Evolving Dataset of Real-World Data

Phishing represents one of the most rapidly evolving cyber threats. This paper introduces a novel dataset of 2,353 posts with 3,838 images, containing 1,538 human-annotated phishing examples in both German and English. The examples were collected from real-world instances found on the Reddit social media platform and reported by Germany's consumer protection organization (Verbraucherzentrale). The dataset is particularly timely, reflecting the latest trends in phishing across different communication platforms, including emails, letters, and social networks. We employ Gemini 2.0 Flash (experimental), a large multimodal model for optical character recognition to extract textual content, identify whether the provided content is related to phishing, and analyze various attributes of phishing attacks. Our analysis includes both automated detection and manual evaluation, with the LMM identifying 1,758 phishing cases from images alone and 1,971 cases when including comment context. Furthermore, we conduct an automatic analysis of the discussions within the Reddit posts to provide additional context for phishing identification. This multimodal approach provides a comprehensive understanding of current phishing tactics, offering valuable insights to improve phishing detection and prevention efforts, while maintaining a continuously updated dataset that reflects the evolving nature of phishing threats.