An Explainable Zero-Trust Framework for Detecting Generative-AI-Enhanced Phishing and Credential Theft Using Real-World Threat Data

Phishing has evolved from simple fraudulent messages into a multi-channel credential-theft ecosystem thatcombines malicious URLs, QR-code phishing, adversary-in-the-middle proxying, business e-mail compromise,deepfake-assisted social engineering, and generative-AI-assisted content generation. This paper proposes anexplainable zero-trust framework for detecting and reducing phishing-related credential exposure using real-worldthreat intelligence and the PhiUSIIL public benchmark dataset. The study integrates APWG observations from2024 through Q3 2025 with a benchmark containing 235,795 URLs, 54 variables, 134,850 legitimate samples,and 100,945 phishing samples. The framework combines URL and page-content features, brand-mismatch evi-dence, QR-code detonation, sender-authentication signals, phishing-resistant MFA, conditional access, browserisolation, and human-readable explanations. A supervised benchmark experiment was conducted using a singlestratified 80/20 train-test split and three baseline classifiers. Decision Tree achieved 100.00% F1-score, RandomForest achieved 99.9975% F1-score, and Gaussian Naive Bayes achieved 98.1923% F1-score on the held-outtest set. These single-split benchmark results support a layered conclusion: URL detection is useful, but strongerrisk reduction is achieved when detection, identity, isolation, reporting, and continuous governance operate asone zero-trust system.