With the rapid expansion of wireless infrastructure and smart devices, short video platforms have become a staple of modern digital ecosystems, offering convenience but also introducing new risks. One such risk is illicit promotional content (IPC), which encompasses deceptive or fraudulent material intended to promote products, services, or events in violation of platform policies. As these platforms grow in popularity, so too does the threat of IPC, which has adapted to the short video format, referred to here as Short Video-Illicit Promotional Content (SVIPC). The detection of SV-IPC is crucial to protect users, especially minors, from fraudulent schemes and harmful material. Current detection approaches primarily rely on image processing, text analysis, and QR code detection, limiting their effectiveness on short video platforms. This paper provides a comprehensive investigation into SV-IPC and its evasion techniques, revealing the underlying ecosystem of illicit promotion. To address these challenges, we introduce a hybrid detection framework that integrates natural language processing with video analysis. Extensive experiments conducted on Chinese TikTok validate the proposed scheme, demonstrating high effectiveness with an F1-score of 90.7%, recall of 90.3%, and precision of 91.2%. This study underscores the broader societal implications of SV-IPC and the importance of enhanced detection mechanisms.

Phishing detectors trained on public benchmarks score highly in-domain yet miss scams aimed at university users. We audit TF-IDF, MiniLM and RoBERTa detectors with 5146 scams published by five U.S. universities, 594 scams posted since 2023, 2684 legitimate university announcements and mailing-list messages, and 17,880 labelled job advertisements. In one benchmark, message year separates phishing from legitimate mail; in both, donor-identifying terms, 2% of the vocabulary, carry 14–16% of the legitimacy weight. Trained on that benchmark, TF-IDF and RoBERTa detect scams containing academic vocabulary about 15 percentage points less often. Thresholds set for a 5% false-positive rate on benchmark mail flag between 1.0% and 87.8% of legitimate job advertisements. Calibrated instead on job advertisements grouped by company, TF-IDF flags 2.1% of university announcements but 65.3% of short legitimate financial messages, and appended legitimate-looking words cut its recall from 0.828 to 0.123. Bounding legitimacy evidence yields closed-form certificates for whitespace-delimited appends, prepends and interior insertions. A budget-split ensemble certifies 0.259 recall against appends or prepends of any length at 0.706 clean recall, whereas adversarially trained TF-IDF falls to 0.078 under a 40-token white-box append. Monotone components, however, flag many long formal letters.

Phishing attacks have reached record levels, with attackers increasingly employing sophisticated evasion techniques such as cloaking, fingerprinting, and CAPTCHAs to circumvent traditional detection systems. Most existing approaches analyze webpage source code, JavaScript, and HTTP headers-artifacts that users never see and that can be manipulated to evade automated scanners. Moreover, deep learning-based detectors function as black boxes, producing accurate predictions but failing to provide interpretable explanations that build user resilience or support security analyst workflows. This disconnect between detection mechanisms and real-world incident reporting creates significant operational challenges, as users naturally capture screenshots and URLs when encountering suspicious pages through help-desk tickets or browser reporting inter-faces. We present a zero-shot explainable phishing detection system that operates exclusively on webpage screenshots and URLs-precisely the evidence users capture in practice. Our approach leverages GPT-4 Vision, a large multimodal language model, to achieve brand recognition and phishing intent detection without requiring task-specific training data. Through carefully designed chain-of-thought prompting, the system decomposes detection into interpretable reasoning steps: identifying the impersonated brand from visual and textual cues, analyzing credential request mechanisms, and detecting social engineering tactics. This structured reasoning process generates natural language explanations as integral components of detection rather than post-hoc rationalizations, making the system inherently explainable. We evaluate our system on the CIRCL Phishing Dataset. Our zero-shot approach achieves 82.0 percent accuracy on brand recognition. Additionally, our system provides an explainable AI agent that transforms technical outputs into multi-level educational explanations tailored to end users, security ana-lysts, and training programs, with visual annotations highlighting suspicious elements. Our work demonstrates that zero-shot large language models can achieve state-of-the-art phishing detection while providing inherent explainability, immediate deployment capability, and adaptability to emerging threats through prompt engineering. By aligning with real-world incident response work-flows and transforming detection from reactive blacklisting into proactive user education, this approach addresses critical gaps in both accuracy and interpretability for practical cybersecurity defense.