An Explainable Zero-Trust Framework for Detecting Generative-AI-Enhanced Phishing and Credential Theft Using Real-World Threat Data

Phishing has evolved from simple fraudulent messages into a multi-channel credential-theft ecosystem that
combines malicious URLs, QR-code phishing, adversary-in-the-middle proxying, business e-mail compromise,
deepfake-assisted social engineering, and generative-AI-assisted content generation. This paper proposes an
explainable zero-trust framework for detecting and reducing phishing-related credential exposure using real-world
threat intelligence and the PhiUSIIL public benchmark dataset. The study integrates APWG observations from
2024 through Q3 2025 with a benchmark containing 235,795 URLs, 54 variables, 134,850 legitimate samples,
and 100,945 phishing samples. The framework combines URL and page-content features, brand-mismatch evi-
dence, QR-code detonation, sender-authentication signals, phishing-resistant MFA, conditional access, browser
isolation, and human-readable explanations. A supervised benchmark experiment was conducted using a single
stratified 80/20 train-test split and three baseline classifiers. Decision Tree achieved 100.00% F1-score, Random
Forest achieved 99.9975% F1-score, and Gaussian Naive Bayes achieved 98.1923% F1-score on the held-out
test set. These single-split benchmark results support a layered conclusion: URL detection is useful, but stronger
risk reduction is achieved when detection, identity, isolation, reporting, and continuous governance operate as
one zero-trust system.