Phishing attacks remain a significant cybersecurity threat, with phishing websites serving as a primary tool for attackers to deceive users and steal sensitive information. The rapid evolution of phishing tactics has spurred the development of increasingly sophisticated detection mechanisms. This paper provides a comprehensive review of state-of-the-art techniques for phishing website detection, highlighting recent advancements in the field. In particular, it addresses emerging methods for detection, such as graph-based, large language model (LLM)-based approaches and phishing kit-based detection methods, which have not been extensively covered in previous surveys. By critically reviewing recent works from reliable databases, this study constructs a new taxonomy for phishing detection techniques. This review offers a comparison of these techniques, highlighting their strengths and limitations, and explores the challenges of real-world applications of these detection systems. Furthermore, the role of artificial intelligence (AI) in phishing website detection is discussed, and future research directions to improve detection capabilities are suggested. This work addresses emerging and uncovered phishing website detection methods in previous review papers and provides valuable insights for both researchers and practitioners working to develop more robust phishing website detection systems.

Amid the exponential rise of Internet of Things (IoT) devices, the Message Queue Telemetry Transport (MQTT) protocol has gained prominence due to its efficiency in facilitating device-cloud interactions. Yet, the surge in IoT device usage and MQTT’s popularity has spotlighted potential security risks. Vulnerabilities in this realm can lead to substantial disturbances and financial setbacks. While there is a noticeable increase in IoT-related attacks, comprehensive reviews on MQTT security remain scarce. Existing studies often exhibit shortcomings, such as a broad but superficial discussion of MQTT attacks and countermeasures. Additionally, many essential components and roles in building or implementing MQTT-based applications have not been adequately addressed. This research fills this void by offering a contemporary analysis of MQTT ecosystem security challenges, encompassing prevalent attacks, their repercussions, mitigation strategies, and prospective areas for further research. This study presents a comprehensive taxonomy of security attacks within the MQTT ecosystem, offering a systematic framework to guide researchers, businesses, and end-users in mitigating these risks. As a result, this work serves as a crucial resource for enhancing the security of IoT devices utilizing MQTT, marking a significant stride in safeguarding IoT infrastructure.

Phishing represents a cybersecurity attack strategy commonly employed by cybercriminals to unlawfully acquire sensitive user information, including passwords, account details, credit card data, and other personally identifiable information. Phishing websites bear a striking resemblance to their legitimate counterparts, thus rendering them inconspicuous and challenging for an unsuspecting user to identify. Criminals and phishing experts frequently leverage cloaking mechanisms to evade detection software and web crawlers. This paper provides a comprehensive systematic review of primary studies conducted between 2012 and 2022 on using cloaking techniques to evade detection by anti-phishing entities based on data extracted from Scopus, Web of Science, and Google Scholar. Different server-side and client-side detection strategies, phishing techniques and cloaking mechanisms, toolkits, blacklists, phishing or anti-phishing ecosystems, and other such concepts have been taken as thematic outputs of the study and have been discussed in detail. This systematic literature review (SLR) is one of the first reviews to be conducted for analyzing the current cloaking or evasion techniques used by phishers, and the limitations of the study have been outlined as well.

Phishing attacks remain a significant cybersecurity threat, exploiting social engineering techniques to deceive users and steal sensitive information. Traditional phishing detection mechanisms based on machine learning and deep learning often rely on centralized data collection, raising privacy concerns and limiting adaptability to diverse user environments. Recent advancements in large language models (LLMs) have introduced new opportunities for phishing detection by leveraging multimodal data, yet existing approaches primarily depend on commercial LLMs, which increase operational costs and potentially compromise user privacy. To address these challenges, we propose FedPhishLLM, a privacy-preserving and explainable phishing detection framework that integrates federated learning (FL) with fine-tuned multimodal LLMs. Our approach enables decentralized model training, allowing users to collaboratively improve phishing detection without sharing raw data, thereby preserving privacy while maintaining high detection accuracy. FedPhishLLM enhances explainability by providing phishing explanations, including brand identification and intent recognition, fostering user trust and informed decision-making. Experimental results confirm that our framework outperforms all baseline models, achieving up to 95% accuracy, precision, and F1-score with 96% recall. Further analyses validate the rationality of chosen training parameters and prompting strategies, demonstrate the complementary value of multimodal phishing indicators, and highlight the framework’s adaptability to linguistic heterogeneity as well as resilience against adversarial and evasive attacks. To the best of our knowledge, FedPhishLLM is one of the first FL-based multimodal LLM approaches for phishing detection, offering a scalable, privacy-conscious, and explainable security solution practical for real-world deployments.

The exponential rise of phishing attacks has become a critical threat to online security, exploiting both system vulnerabilities and human psychology. Although anti-phishing blacklists serve as a primary defense mechanism, they are limited by incomplete coverage and delayed updates, making them susceptible to evasion by sophisticated attackers. This study presents a comprehensive security analysis of anti-phishing blacklists and introduces two novel cloaking attacks—Feature-Driven Cloaking and Transport Layer Security (TLS)-Based Cloaking—that exploit vulnerabilities in the automated detection systems of anti-phishing entities (APEs). Using real-world data and employing machine learning techniques, the Random Forest (RF) classifier emerged as the most effective among all tested supervised classifiers, achieving 100% accuracy in distinguishing APEs from regular users and enabling attackers to bypass blacklist detection. Key findings highlight critical security flaws in major APEs, including limited infrastructure diversity, feature implementation inconsistencies, and vulnerabilities to Web Real-Time Communication (WebRTC) Internet Protocol (IP) leaks. These weaknesses extend the operational lifespan of phishing websites, heightening risks to users. The results emphasize the need for APEs to implement more robust and adaptive defenses and propose mitigation strategies to enhance the resilience of the anti-phishing ecosystem.