Cardiff Met researchers highlight double-edged role of AI in the fight against phishing

Researchers from Cardiff Metropolitan University have contributed to a major international study which has revealed how large language models (LLMs) are making phishing attacks more convincing, while also improving cyber defence capabilities.

The paper, A systematic literature review of large language models in phishing attack generation and detection, published in the journal Array, investigates the growing influence of LLMs and shows how artificial intelligence is transforming both the creation and detection of phishing attacks, one of the most persistent cyber threats facing organisations and individuals today.

An international team of researchers including Dr Chaminda Hewage, and Dr Rajkumar Rathore from the Cybersecurity and Information Networks Centre (CINC) at Cardiff Met, analysed research published between January 2023 and April 2025.

The study found that LLMs are significantly increasing the sophistication of phishing attacks by enabling cybercriminals to generate highly convincing, contextually relevant emails and fraudulent websites at scale. By automating content creation and reducing the level of technical expertise required, AI-powered tools have the potential to increase the effectiveness and reach of phishing campaigns.

However, the research also highlights the positive role LLMs can play in cyber defence. The findings show that AI-powered detection systems can analyse content to identify phishing attempts more effectively than many traditional approaches.

The authors conclude that LLMs have accelerated and automated phishing-related processes, simultaneously intensifying cyber risks while advancing defensive capabilities. They also warn that multimodal phishing attacks, which combine text, images and other AI-generated content, are likely to become increasingly common as generative AI tools become more widely adopted.

Dr Chaminda Hewage said:

“Artificial intelligence is fundamentally changing the cybersecurity landscape. While large language models are giving attackers new tools to create more persuasive phishing content, they are also providing defenders with powerful capabilities to detect and prevent these threats.

“Our review highlights the need for continued investment in AI-driven security solutions, alongside greater awareness of the risks associated with generative AI technologies. Understanding both sides of this rapidly evolving technology is essential if organisations are to stay ahead of emerging cyber threats.”

A systematic literature review of large language models in phishing attack generation and detection was published in Array in 2026 and was co-authored by researchers from Cardiff Metropolitan University, the University of Greenwich, Pukyong National University, the University of Essex, and the Beijing University of Posts and Telecommunications.