# PhishLumos: An Adaptive Multi-Agent System for Proactive Phishing Campaign Mitigation

arXiv: https://arxiv.org/abs/2509.21772 · HTML: https://mlsanity.com/paper/2509.21772/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 12 of its 58 references that are in the map.
- First posted on arXiv 26 Sep 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 12 of 12)

- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection](https://mlsanity.com/paper/2403.02253/) (2024)
- [ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection](https://mlsanity.com/paper/2402.18093/) (2024)
- [PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detection](https://mlsanity.com/paper/2408.10738/) (2024)
- [Phishing URL Detection: A Network-based Approach Robust to Evasion](https://mlsanity.com/paper/2209.01454/) (2022)
- [ShamFinder: An Automated Framework for Detecting IDN Homographs](https://mlsanity.com/paper/1909.07539/) (2019)
- [PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites](https://mlsanity.com/paper/2508.02035/) (2025)
- [Canary in Twitter Mine: Collecting Phishing Reports from Experts and Non-experts](https://mlsanity.com/paper/2303.15847/) (2023)
- [PhishReplicant: A Language Model-based Approach to Detect Generated Squatting Domain Names](https://mlsanity.com/paper/2310.11763/) (2023)
- [DomainLynx: Leveraging Large Language Models for Enhanced Domain Squatting Detection](https://mlsanity.com/paper/2410.02095/) (2024)
- [DomainHarvester: Harvesting Infrequently Visited Yet Trustworthy Domain Names](https://mlsanity.com/paper/2410.02097/) (2024)
- [ScamFerret: Detecting Scam Websites Autonomously with Large Language Models](https://mlsanity.com/paper/2502.10110/) (2025)

## Abstract (arXiv)

Phishing attacks are a significant societal threat, disproportionately harming vulnerable populations and eroding trust in essential digital services. Current defenses are often reactive, failing against modern evasive tactics like cloaking that conceal malicious content. To address this, we introduce PhishLumos, an adaptive multi-agent system that proactively mitigates entire attack campaigns. It confronts a core cybersecurity imbalance: attackers can easily scale operations, while defense remains an intensive expert task. Instead of being blocked by evasion, PhishLumos treats it as a critical signal to investigate the underlying infrastructure. Its Large Language Model (LLM)-powered agents uncover shared hosting, certificates, and domain registration patterns. On real-world data, our system identified 100% of campaigns in the median case, over a week before their confirmation by cybersecurity experts. PhishLumos demonstrates a practical shift from reactive URL blocking to proactive campaign mitigation, protecting users before they are harmed and making the digital world safer for all.