Multimodal AI for Detecting Evolving Phishing Attacks and Social Engineering

Phishing and social engineering combine technical impersonation with psychological manipulation, exploiting urgency, authority, trust, fear, and curiosity to induce unsafe actions. Detection systems based on a single signal—such as a URL blacklist, lexical URL features, or message text—may fail when attackers rotate domains, paraphrase lures, clone legitimate interfaces, or move between communication channels. This paper presents a research framework for multimodal phishing detection that integrates four evidence streams: message text and persuasion cues; URL and domain structure; webpage HTML and visual appearance; and contextual technical metadata. Each modality is processed by a specialized encoder, while early, late, and confidence-aware gated fusion are compared under a shared evaluation protocol. The proposed protocol prioritizes temporal and domain-separated testing, duplicate control, calibration, explainability, missing-modality resilience, and inference cost. Candidate sources include public phishing webpage benchmarks and threat feeds, subject to licensing and label-quality checks. The framework is a research proposal rather than a report of completed experiments; therefore, no performance results are asserted. Its intended contribution is a reproducible way to test when multimodal evidence improves detection of evolving campaigns and when additional complexity fails to justify its cost.