[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-build-a-phishing-detector-that-fact-checks-emails":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},6239,"researchers-build-a-phishing-detector-that-fact-checks-emails","Researchers Build a Phishing Detector That Fact-Checks Emails","PiMRef fact-checks a sender's claimed identity against real-world data to catch AI-generated spear-phishing that fools pattern-based filters.","A team of researchers has built a phishing detector that fact-checks emails instead of just scanning them for suspicious patterns.\n\nThe researchers first showed that large language models can generate convincing, profile-grounded spear-phishing emails well enough to slip past major existing detection paradigms. In response, they built PiMRef, a system that checks whether an email's claimed sender identity actually lines up with real-world facts. It extracts the identity a sender claims to have, checks that identity's email domain against an expandable knowledge base, and flags the call-to-action instructions phishing emails use to prompt clicks or replies. Tested against detectors including D-Fence, HelpHed, and ChatSpamDetector on the Nazario and PhishPot benchmarks, PiMRef held its false-positive rate to 0.81% while catching 90.7% to 93.1% of phishing emails. On a new benchmark the team built, called SpearMail, made up of 14,672 LLM-generated spear-phishing emails targeting 681 public profiles, PiMRef caught 86.4% of them without generating extra false alarms.\n\nMost phishing filters rely on style cues: bad grammar, sketchy links, known scam templates. LLMs can now write emails that avoid all three while still lying about who sent them, which is exactly the gap PiMRef targets. Checking claims against facts rather than writing style is a sturdier defense, because it does not degrade as attackers get better at sounding human.\n\nIt is also a reminder that the same models being pitched as productivity tools are already being used to automate the exact con this system was built to catch.","[\"phishing\",\"cybersecurity\",\"llm\",\"ai\"]","2026-09-10T04:00:00.000Z","2026-09-10T11:02:36.440Z","2026-09-10T11:02:48.365Z","published",null,[],"security",[26,27,28,29],"phishing","cybersecurity","llm","ai",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2507.15393",0,{"sections":36},[37,41,44,49,54,59,64,68,73,78,83,88,93,98],{"name":38,"slug":29,"count":39,"latest_published_at":40},"AI",3480,"2026-09-11T04:00:00.000Z",{"name":42,"slug":24,"count":43,"latest_published_at":40},"Security",629,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",336,"2026-09-11T00:56:21.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",153,"2026-09-09T15:12:32.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":40},"Science","science",98,{"name":69,"slug":70,"count":71,"latest_published_at":72},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"General","general",41,"2026-09-08T01:57:23.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]