Phishing websites remain a persistent cybersecurity threat because they can be rapidly generated, visually disguised, and adapted to evade static detection mechanisms. Although machine learning-based phishing detection has shown strong performance, many existing approaches rely on offline training or fixed model selection, which may be unsuitable for continuously evolving streams. Incremental learning addresses this limitation by allowing models to update continuously as new instances arrive. However, selecting a single incremental learner before deployment may be restrictive, while using a full ensemble can increase prediction latency, update time, and memory demand. To address this challenge, this paper investigates a multi-armed bandit (MAB)-based online model selection framework for incremental phishing detection. In the proposed framework, heterogeneous incremental learning pipelines are treated as candidate arms, and a bandit policy dynamically selects one learner for each incoming instance based on observed rewards. Several MAB policies are evaluated, including Random selection, Epsilon-Greedy, UCB, Bayes-UCB, Thompson Sampling, EXP3, and LinUCB. The study further compares three update strategies: selected-only update, hybrid update, and all-model update. The framework is evaluated against individual incremental learners and a full ensemble baseline using accuracy, precision, recall, F1-score, Cohen’s kappa, timing decomposition, memory footprint, and arm selection behavior. The results show that MAB-based selection provides a flexible trade-off between predictive reliability and computational efficiency. The strongest standalone learner remains highly competitive, but hybrid and all-model MAB configurations approach its performance while offering adaptive model selection. Selected-only MAB provides the lowest processing cost, all-model MAB provides stronger predictive reliability at higher computational cost, and hybrid MAB offers the most practical balance. The findings highlight the value of MAB-based online model selection as a resource-aware mechanism for adaptive phishing detection in streaming environments.