An Explainable Zero-Trust Framework for Detecting Generative-AI-Enhanced Phishing and Credential Theft Using Real-World Threat Data

Phishing has evolved from simple fraudulent messages into a multi-channel credential-theft ecosystem that combines malicious URLs, QR-code phishing, adversary-in-the-middle proxying, business e-mail compromise, deepfake assisted social engineering, and generative-AI-assisted content generation. This paper proposes an explainable zero-trust framework for detecting and reducing phishing-related credential exposure using real-world threat intelligence and the PhiUSIIL public benchmark dataset. The study integrates APWG observations from 2024 through Q3 2025 with a benchmark containing 235,795 URLs, 54 variables, 134,850 legitimate samples, and 100,945 phishing samples. The framework combines URL and page-content features, brand-mismatch evidence, QR-code detonation, sender-authentication signals, phishing-resistant MFA, conditional access, browser isolation, and human-readable explanations. A supervised benchmark experiment was conducted using a single stratified 80/20 train-test split and three baseline classifiers. Decision Tree achieved 100.00% F1-score, Random Forest achieved 99.9975% F1-score, and Gaussian Naive Bayes achieved 98.1923% F1-score on the held-out test set. These single-split benchmark results support a layered conclusion: URL detection is useful, but stronger risk reduction is achieved when detection, identity, isolation, reporting, and continuous governance operate as one zero-trust system.