ARCHIVES

Phishing and social engineering combine technical impersonation with psychological manipulation, exploiting urgency, authority, trust, fear, and curiosity to induce unsafe actions. Detection systems based on a single signal—such as a URL blacklist, lexical URL features, or message text—may fail when attackers rotate domains, paraphrase lures, clone legitimate interfaces, or move between communication channels. This paper presents a research framework for multimodal phishing detection that integrates four evidence streams: message text and persuasion cues; URL and domain structure; webpage HTML and visual appearance; and contextual technical metadata. Each modality is processed by a specialized encoder, while early, late, and confidence-aware gated fusion are compared under a shared evaluation protocol. The proposed protocol prioritizes temporal and domain-separated testing, duplicate control, calibration, explainability, missing-modality resilience, and inference cost. Candidate sources include public phishing webpage benchmarks and threat feeds, subject to licensing and label-quality checks. The framework is a research proposal rather than a report of completed experiments; therefore, no performance results are asserted. Its intended contribution is a reproducible way to test when multimodal evidence improves detection of evolving campaigns and when additional complexity fails to justify its cost.