PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants

Phishing email is a critical step in the cybercrime kill chain due to the high reachability of victims' email accounts and the low cost of launching phishing campaigns. The proportion of AI-generated phishing emails peaked at 82.6% in 2025, and showed a higher click-through rate than manually written ones. This ever-evolving nature of phishing emails makes traditional rule-based and featureengineering-based phishing email detectors fight an uphill battle in the cat-and-mouse game of defense and attack.

In this work, we show that, large language models (LLMs) can be effectively exploited to generate profile-grounded spear-phishing, compromising major paradigms of phishing email detectors. To defend against such LLM-based spear-phishing attacks, we propose PiMRef, the first reference-based solution to detect ever-evolving phishing emails using knowledge-based invariants, targeting the identity-impersonation attacks that characterize spear-phishing. Our rationale lies in the fact that convincing phishing emails often include "disprovable claims", which contradict certain real-world facts. Therefore, we reduce the problem of phishing email detection to an identity fact-checking problem on the sender's identity within the email context, enabling defenses against evolving phishing threats with high accuracy and explainability. Technically, given an email, PiMRef (i) discovers the claimed identity of the sender, (ii) verifies the sender's email domain against a dynamically expandable knowledge base, and (iii) infers call-to-action instructions that encourage next-step engagement. The detected contradictory identity facts serve as both alarms and explanations.

Compared to existing baselines such as D-Fence, HelpHed, and ChatSpamDetector, PiMRef reduces the false-positive rate to 0.81%