Pith. sign in

REVIEW 2 major objections 3 minor 117 references

The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations

T0 review · 2 major / 3 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read QR-code phishing emails lure employees to fake login pages just as often as traditional click-through buttons, and LLM-written emails add a cheap, high-impact vector.

desk verdict Useful first multi-org field data on quishing and LLM/OSINT phishing, but the headline RQ1 equivalence claim rides on a company-run, uncontrolled E_Q at the largest site and needs a reanalysis before it can be taken at face value. read the letter →

arxiv 2505.12104 v1 pith:I6T7VUVW submitted 2025-05-17 cs.CR

Marie Weinz , Nicola Zannone , Luca Allodi , Giovanni Apruzzese This is my paper · ORCID
classification cs.CR
keywords phishingquishingQRcodesLLM-generatedOSINTsimulationperceivedawarenessorganizationalsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that two emerging phishing vectors are at least as dangerous as the classic one. Across 71,309 emails sent to employees of three organizations, QR-code phishing ("quishing") brought users to a fake login page at the same rate as a nearly identical email with a click-through button, with an equivalence test placing the difference below one percent. The paper also tries to show that feeding publicly available company information to a free large language model produces phishing emails that are cheap to craft and highly effective, with over 30% of opened emails in the mid-sized company leading to the landing page. A survey of 131 employees suggests that higher self-reported "perceived phishing awareness" predicts lower measured susceptibility to these campaigns. If these claims hold, organizations cannot assume that QR codes add protective friction, and they face a new class of low-cost, personalized phishing.

What carries the argument

The load-bearing object is a controlled pair of near-identical phishing emails: E_B embeds the URL in a click-through button; E_Q replaces that button with a QR code while keeping the design, pretext, and landing page the same. This isolates the interaction mechanism as the variable of interest. The second mechanism is an OSINT-to-LLM pipeline: data from an employer-rating site, social-network posts, and press releases is summarized by a free LLM through a five-prompt sequence to produce a persuasive company-survey invitation (E_L). The third mechanism is a 40-question survey, rooted in knowledge-attitude-behavior principles, whose aggregated score (PPA) is regressed against the phishing click-through rate (PS) per company.

What would settle it

Run a single-organization randomized controlled trial where E_B and E_Q are sent simultaneously from the same platform to randomly split employees, with identical pretext and landing page; if the QR arm's landing-page visit rate falls outside the ±1% equivalence margin relative to the button arm, the paper's RQ1 claim fails. A cheaper check: re-analyze the multinational data using only the concurrently randomized half of employees who received E_B and the matched E_Q population, and see whether the 8.1% vs 7.9% aggregate result still holds.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is a pair of empirical equivalences and one correlation. RQ1: employees who open a quishing email reach the credential-harvesting webpage about as often as employees who open a traditional button-based email (aggregate 8.0% vs 8.5% of opened emails, p=.276 for the one-tailed difference, with a TOST equivalence within ±1%). RQ2: an email written by a free LLM using OSINT from employer-rating sites, LinkedIn, and press releases outperformed both traditional emails in the small and mid-sized companies (66.6% and 31.5% of opened emails led to the landing page respectively, versus 22.2% and 3.9% for the button email), although it underperformed them at the multinational. RQ3: a linear regression across the three companies found perceived phishing awareness a significant negative predictor of phishing susceptibility (slope -24.2, p<.001).

Load-bearing premise

For RQ1, the paper assumes the button and QR emails differ only in interaction mechanism within each organization, but at the largest company the QR campaign was run earlier by the company itself on all employees, so timing, population, platform, and prior training exposure are not controlled.

Editorial extensions

If this is right

  • Security teams cannot treat QR codes as a natural defense: quishing reached the landing page at the same rate as a button, so training and detection must treat QR codes as a first-class phishing vector.
  • LLM-generated emails fed with public information are cheap to produce and can outperform carefully crafted traditional phishing emails, particularly in smaller, more homogeneous organizations.
  • Perceived phishing awareness, measured by survey, may serve as a rough predictor of organizational phishing susceptibility, allowing pre-emptive training prioritization.
  • Because quishing URLs are hard for standard filters to see, client-side QR scanning with URL checks becomes a plausible defense, alongside including quishing in simulated phishing exercises.
  • The finding that fewer credentials were submitted after QR scans relative to button clicks suggests the device gap between scanning and typing credentials may be a real mitigation point, though the paper attributes this partly to experimental setup.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's aggregate quishing equivalence is dominated by the multinational's earlier QR campaign, which was not run concurrently or on the same platform as the button email; a fully matched randomized comparison could either confirm or narrow the equivalence.
  • If the PPA-PS relationship generalizes beyond three companies, annual survey-based PPA scoring could become a low-cost diagnostic for organizations before investing in phishing training.
  • The OSINT+LLM result implies attackers can automate the reconnaissance-to-email pipeline; one testable extension is measuring whether adding urgency or loss cues to E_L pushes its already high click rates higher.
  • The lower credential-submission rate after QR scans may be a device artifact (credentials stored in a password manager on a work device); testing with a mobile-friendly password autofill landing page would separate friction from skepticism.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 3 minor

Summary. This paper presents a field study of phishing susceptibility across three organizations (an SME, a mid-size financial company, and a large manufacturer), based on 71,309 sent emails. Three email types are compared: a traditional button-based phishing email (E_B), a nearly identical QR-code phishing email (E_Q), and an OSINT-fed LLM-generated phishing email (E_L). The authors claim that E_B and E_Q have practically the same effectiveness (RQ1), that LLM/OSINT email is cheap and highly effective especially against smaller companies (RQ2), and that a perceived-phishing-awareness score is a statistically significant predictor of phishing susceptibility (RQ3). The paper also reports a survey of 131 employees and an original demonstration that QR-code emails evade a commercial filter.

Significance. The paper contains rare and valuable multi-organization field data, with fine-grained per-company breakdowns, a transparent appendix, and ethical disclosures. The filter-evasion demonstration in Appendix B is a useful original contribution, and the dataset could serve as a benchmark for later work. However, the two central inferential claims need substantial qualification: the RQ1 equivalence conclusion is dominated by an uncontrolled company-run quishing campaign at C_h, and the RQ3 regression is fit to only three company-level points. The descriptive material is significant, but the paper's strong conclusions currently outrun the evidence.

major comments (2)
  1. [§4.2.2, §5.2, Table 2] The RQ1 equivalence claim is not established because the largest company does not provide a controlled button-vs-QR comparison. For C_h, E_Q was run by the company itself in January 2024 and sent to all employees, while E_B was sent by the authors in April/May 2024 to a random half of employees; the two conditions therefore differ in timing, population, sender infrastructure, and prior exposure to quishing simulations and training. The statement in §4.2.2 that these variations are harmless because E_Q and E_B 'retain consistent properties within each organization' is not justified for C_h, and the claim that E_B was designed to 'match' the company-run E_Q is unverifiable under NDA. Since C_h accounts for 34,031 of 34,610 E_Q emails and 17,751 of 18,339 E_B emails, the aggregate click rates and the TOST equivalence at ±1% are essentially an uncontrolled C_h statement. Recomputing on C_s and C_m alone gives E_B 14/321 (4.4%) versus E_Q 20/330 (6.1%), a difference of about 1.7 percentage points with a confidence interval far wider than ±1%; the equivalence conclusion cannot be reproduced on the controlled subset. The authors should either provide a sensitivity analysis that excludes C_h, or substantially weaken the RQ1 conclusion in §5.2, the abstract, and the contributions.
  2. [§6.2, Fig. 11] The RQ3 claim that perceived phishing awareness is a 'predictor' of phishing susceptibility is based on a linear regression with only three company-level data points (n=3), which yields R²=1, p<.001, and Spearman's ρ=-1 by construction. Adding the aggregate as a fourth point does not solve the problem because that point is a weighted combination of the same three observations and is not independent. With three points, the model cannot provide meaningful evidence for a predictive relationship; a perfect fit is a mathematical artifact. The paper should reframe RQ3 as an exploratory observation about three companies, and should not present the fitted line, or the derived PPA=1 or PPA=4.7 predictions, as a general predictive model.
minor comments (3)
  1. [§5.2] The text states that for E_Q '25,172 employees opened it, and 1,970 (8.49%) visited the landing page,' but Table 2 reports 7.8% for this ratio (1,970/25,172 = 7.83%). Please reconcile the rate in the text with the table.
  2. [§5.2] The company-specific one-tailed chi-square p-values should be verified: for C_m, chi-square=0.514 cannot yield a one-tailed p-value of 1.0 under the stated directional hypothesis. Even if the conclusion is unchanged, the reported p-value appears incorrect and should be recomputed or the test described more precisely.
  3. [§4.3] The questionnaire was distributed after the phishing simulations, and the paper assumes it is 'reasonable to expect' that respondents had also taken part in the simulation. This should be stated more cautiously as an assumption, since the responses cannot be linked to individual simulation outcomes.

Circularity Check

1 steps flagged · score 2.0 of 10

Empirical field study with no derivation chain; the only mild circular step is the RQ3 regression, whose 'predictions' are read off the same fitted line used to establish the predictor claim.

  1. fitted input called prediction [Section 6.2 (Statistical Assessment of PPA and PS [RQ3])]
    "After fitting a linear regression model (shown in Fig. 11 in Appendix E.3), we obtain the following results. First, the coefficient of determination is 1.0... Given that the PPA score ranges between 1–5, we use our linear regression model to estimate the corresponding PS-score."

    The regression slope (-24.2), intercept (113.45), and p-value are fit to exactly the three company-level (PPA-score, PS-score) pairs from C_s, C_m, and C_h. The subsequent 'prediction' of PS-score from PPA-score is then evaluated on this same fitted line, and the claim that PPA 'can be a statistically significant predictor' is supported by an in-sample p-value on the fitting data. The predicted values are therefore restatements of the fitted model rather than independent confirmations. This does not affect RQ1 or RQ2, which are based on direct measurements of the simulations.

full rationale

The paper is an empirical field study with no mathematical derivation from first principles, so the derivation-equivalence form of circularity is largely absent. RQ1 compares measured click-through ratios from E_B and E_Q using chi-square and TOST tests; the main weakness there is a confounding of the button-vs-QR variable at C_h (company-run E_Q sent earlier to all employees vs. authors' later E_B to a random half), but that is a validity threat, not a circular reduction. RQ2 is a qualitative analysis of a separate LLM/OSINT-crafted email and does not rename or redefine its inputs. The only step that fits a circularity pattern is RQ3: a linear regression fitted to three company-level points is used to 'predict' PS from PPA, and the same in-sample fit is presented as evidence that PPA is a predictor. This is a mild fitted-input-called-prediction issue, not a load-bearing self-citation or definitional circularity. The paper's self-citations (e.g., Burda et al. for SME behavior, Apruzzese et al. for offensive AI) are contextual and do not carry the central claims. Overall circularity is low.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The claims rest on observable field data rather than new theoretical constructs. The main parametric choices are the equivalence margin and the regression line; neither is an independent physical or model quantity.

free parameters (2)
  • TOST equivalence margin = ±1%
    Chosen by the authors to declare E_B and E_Q equivalent in Section 5.2; with a wider margin the equivalence conclusion could be trivial, and with a narrower margin it might fail. This threshold is not derived from the data.
  • Linear regression slope and intercept for PPA to PS prediction = slope -24.2, intercept 113.45
    Fitted to exactly three company-level data points in Section 6.2 and used to predict PS from PPA. The perfect fit (R²=1.0) reflects interpolation of the fitting points, not external validation.
assumptions (4)
  • domain assumption An email is counted as 'read' if it was opened
    Used throughout Section 5 to compute all click-through ratios. Image-loading settings and whitelisting were adjusted to make opening detectable, but opening is a proxy for reading.
  • domain assumption The malicious URL is not listed in any blocklist
    Stated explicitly in the threat model (Section 3.1). If blocklists prevented access, visit rates would drop regardless of email content.
  • domain assumption E_B and E_Q are identical except for button versus QR code within each organization
    Central to RQ1; violated for C_h in timing, scale, platform, and prior employee exposure (Section 4.2.2 and the C_h row in Table 2).
  • domain assumption Survey respondents are representative of their company's employees
    RQ3 uses 13, 82, and 36 respondents to represent companies; self-selection and small per-company samples make this questionable, acknowledged as a 'gross generalization' in Section 7.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations." pith.science (2026). https://pith.science/paper/I6T7VUVW

@misc{pith2026250512104,
  author       = {Pith},
  title        = {Pith review of: The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I6T7VUVW}},
  note         = {Machine review of arXiv:2505.12104}
}
read the original abstract

Modern organizations are persistently targeted by phishing emails. Despite advances in detection systems and widespread employee training, attackers continue to innovate, posing ongoing threats. Two emerging vectors stand out in the current landscape: QR-code baits and LLM-enabled pretexting. Yet, little is known about the effectiveness of current defenses against these attacks, particularly when it comes to real-world impact on employees. This gap leaves uncertainty around to what extent related countermeasures are justified or needed. Our work addresses this issue. We conduct three phishing simulations across organizations of varying sizes -- from small-medium businesses to a multinational enterprise. In total, we send over 71k emails targeting employees, including: a "traditional" phishing email with a click-through button; a nearly-identical "quishing" email with a QR code instead; and a phishing email written with the assistance of an LLM and open-source intelligence. Our results show that quishing emails have the same effectiveness as traditional phishing emails at luring users to the landing webpage -- which is worrying, given that quishing emails are much harder to identify even by operational detectors. We also find that LLMs can be very good "social engineers": in one company, over 30% of the emails opened led to visiting the landing webpage -- a rate exceeding some prior benchmarks. Finally, we complement our study by conducting a survey across the organizations' employees, measuring their "perceived" phishing awareness. Our findings suggest a correlation between higher self-reported awareness and organizational resilience to phishing attempts.

Figures

Figures reproduced from arXiv: 2505.12104 by the authors.

Figure 1
Figure 1. Emails used in our experiments. Our emails shared a similar design, but each email presented some company-specific traits to increase authenticity (e.g., we put the company logo at the bottom right). All emails bring the user to the same landing webpage (which was also specific to each company). webpage; the number of recipients that reported the message, and the number of submitted credentials. The simulations occu… view at source ↗
Figure 2
Figure 2. Extraction and exploitation of OSINT for [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Landing page. All of our emails would point to a webpage with a similar design as this one, showing the typical “Microsoft login” [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Interface of GoPhish. This is just an example, no confidential information is shown. Internet deployment. We deployed our instance of GoPhish on a virtual private server (VPS) “exposed” to the internet, since we needed it to be operational and accessible during the ent…
Figure 6
Figure 6. Figure 6: Our landing page was initially blocked by Google SafeBrows [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Original QR-code test: preliminaries. We took a URL pointing to a phishing webpage from Phishtank (Fig. 7a), we generated the corresponding QR code (Fig. 7b) and also checked that the webpage had been included in operational blocklists (Fig. 7c) used by popular browser…
Figure 8
Figure 8. Figure 8: Original QR-code test: results. We sent four emails to the institu￾tional email address of one of the authors, managed by Microsoft (i.e., the same provider of the companies considered in our paper—see §4.1). C𝑠 . Recall that, across E𝐵/E𝑄 /E𝐿, 11 employees of C𝑠 reach…
Figure 9
Figure 9. Figure 9: Snippet of the “Attitude towards Cybersecurity” section of [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Snippet of the “quick assessment” section of our question [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Regression model of the perceived phishing awareness (PPA) [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

117 extracted references · 73 canonical work pages

  1. [1]

    A Comprehensive Guide to SMTP Relay: Definitions, Examples, and Best Practices

    2023. A Comprehensive Guide to SMTP Relay: Definitions, Examples, and Best Practices. https://mailtrap.io/blog/smtp-relay/

    2023

  2. [2]

    Anti-phishing protection in Microsoft 365

    2024. Anti-phishing protection in Microsoft 365. https://learn.microsoft.com/en- us/defender-office-365/anti-phishing-protection-about

    2024

  3. [3]

    GoPhish – Open Source Phishing Toolkit

    2024. GoPhish – Open Source Phishing Toolkit. https://getgophish.com/

    2024

  4. [4]

    Cisco Talos

    2024.How are attackers using QR codes in phishing emails and lure documents? Technical Report. Cisco Talos. https://blog.talosintelligence.com/how-are- attackers-using-qr-codes-in-phishing-emails-and-lure-documents/

    2024

  5. [5]

    Cisco Talos

    2024.Malicious QR Codes: How big of a problem is it, really?Technical Report. Cisco Talos. https://blog.talosintelligence.com/malicious_qr_codes/

    2024

  6. [6]

    Phishing Attack Simulation Training–Microsoft Security

    2024. Phishing Attack Simulation Training–Microsoft Security. https://microsof t.com/en-us/security/business/threat-protection/attack-simulation-training

    2024

  7. [7]

    PhishTank

    2024. PhishTank. www.phishtank.org

    2024

  8. [8]

    QR Code Phishing Scams Are on the Rise—Don’t Get Caught - Hoxhunt

    2024. QR Code Phishing Scams Are on the Rise—Don’t Get Caught - Hoxhunt. https://www.hoxhunt.com/blog/qr-code-phishing-scams

    2024

Show all 117 references
  1. [9]

    Simulate a phishing attack with Attack simulation training

    2024. Simulate a phishing attack with Attack simulation training. https: //learn.microsoft.com/en-us/defender-office-365/attack-simulation-training- simulations

    2024

  2. [10]

    Technical Report

    2024.State of the Phish 2024. Technical Report. ProofPoint. https://www.proo fpoint.com/it/resources/threat-reports/state-of-phish

    2024

  3. [11]

    Technical Report

    2024.Top Email Threats and Trends. Technical Report. Barracuda. https://assets .barracuda.com/assets/docs/dms/top-email-threats-and-trends-vol1.pdf

    2024

  4. [12]

    Train Your Office 365 Users Against Phishing Attacks using Attack Simulation Training

    2024. Train Your Office 365 Users Against Phishing Attacks using Attack Simulation Training. https://web.archive.org/web/20250116155243/https: //o365reports.com/2022/02/16/train-your-office-365-users-against-phishing- attacks-using-attack-simulation-training/

    2024

  5. [13]

    2025. Kununu. https://www.kununu.com/

    2025

  6. [14]

    LinkedIn

    2025. LinkedIn. https://www.linkedin.com/

    2025

  7. [15]

    Technical Report

    2025.WhatsApp spear phishing campaign uses QR codes to add device. Technical Report. Malwarebytes Labs. https://www.malwarebytes.com/blog/news/2025/ 01/whatsapp-spear-phishing-campaign-uses-qr-codes-to-add-device

    2025

  8. [16]

    W Prah Angela Aba and Otchere Kojo Ennin Opan

    Abigail N. W Prah Angela Aba and Otchere Kojo Ennin Opan. 2016. The perceived effectiveness of information security awareness.Information and Knowledge Management(2016)

    2016

  9. [17]

    Dania Aljeaid, Amal Alzhrani, Mona Alrougi, and Oroob Almalki. 2020. As- sessment of end-user susceptibility to cybersecurity threats in Saudi Arabia by simulating phishing attacks.Information(2020)

    2020

  10. [18]

    G Amoah and J Hayfron-Acquah. 2022. QR Code security: mitigating the issue of quishing (QR Code Phishing).Int. J. Comput. Appl975 (2022), 8887

    2022

  11. [19]

    Giovanni Apruzzese, Mauro Conti, and Ying Yuan. 2022. SpacePhish: The Evasion-Space of Adversarial Attacks against Phishing Website Detectors Using Machine Learning. InProc. ACSAC

    2022

  12. [20]

    2024.Phishing Activity Trends Report, Q3

    APWG. 2024.Phishing Activity Trends Report, Q3. Technical Report. APWG

    2024

  13. [21]

    Michael Bailey, David Dittrich, Erin Kenneally, and Doug Maughan. 2012. The Menlo report.IEEE Security & Privacy(2012)

    2012

  14. [22]

    Shahryar Baki and Rakesh M Verma. 2023. Sixteen years of phishing user studies: What have we learned?IEEE TDSC(2023)

    2023

  15. [23]

    2014.Handbuch methoden der empirischen sozial- forschung

    Nina Baur and Jörg Blasius. 2014.Handbuch methoden der empirischen sozial- forschung. Vol. 13. Springer

    2014

  16. [24]

    Mazal Bethany, Athanasios Galiopoulos, Emet Bethany, Mohammad Bahrami Karkevandi, Nishant Vishwamitra, and Peyman Najafirad. 2024. Large language model lateral spear phishing: A comparative study in large-scale organizational settings.arXiv:2401.09727(2024)

    2024 arXiv

  17. [25]

    Violino Bob. 2023. AI tools such as ChatGPT are generating a mammoth increase in malicious phishing emails.CNBC(2023). https://www.cnbc.com/2023/11/28/ ai-like-chatgpt-is-creating-huge-increase-in-malicious-phishing-email.html

    2023

  18. [26]

    Pavlo Burda, Luca Allodi, and Nicola Zannone. 2020. Don’t forget the human: a crowdsourced approach to automate response and containment against spear phishing attacks. InW ACCO (co-located with IEEE EuroS&P)

    2020

  19. [27]

    Pavlo Burda, Abdul Malek Altawekji, Luca Allodi, and Nicola Zannone. 2023. The Peculiar Case of Tailored Phishing against SMEs: Detection and Collective DefenseMechanisms at a Small IT Company. InW ACCO (IEEE EuroS&PW)

    2023

  20. [28]

    Alexia Cambon, Brent Hecht, Ben Edelman, Donald Ngwe, Sonia Jaffe, et al

  21. [29]

    2023.AI vs

    Stephanie Carruthers. 2023.AI vs. human deceit: Unravelling the new age of phishing tactics. Technical Report. IBM. https://web.archive.org/web/2024 1009154831/https://securityintelligence.com/x-force/ai-vs-human-deceit- unravelling-new-age-phishing-tactics/

    2023

  22. [30]

    Sunil Chaudhary, Vasileios Gkioulos, and Sokratis Katsikas. 2022. Developing metrics to assess the effectiveness of cybersecurity awareness program.Journal of Cybersecurity(2022)

    2022

  23. [31]

    Casey Deccio, Tarun Yadav, Nathaniel Bennett, Alden Hilton, Michael Howe, Tanner Norton, Jacob Rohde, Eunice Tan, and Bradley Taylor. 2021. Measuring email sender validation in the wild. InCoNEXT

    2021

  24. [32]

    Rachna Dhamija and J Doug Tygar. 2005. The battle against phishing: Dynamic security skins. InSOUPS

    2005

  25. [33]

    Matthew Edwards, Robert Larson, Benjamin Green, Awais Rashid, and Alistair Baron. 2017. Panning for gold: Automatically analysing online social engineering attack surfaces.Comp. Secur.(2017)

    2017

  26. [34]

    2024.Email Security Risk Report

    Egress. 2024.Email Security Risk Report. Technical Report. Egress

    2024

  27. [35]

    Robert Wall Emerson. 2015. Convenience sampling, random sampling, and snowball sampling: How does sampling affect the validity of research?Journal of Visual Impairment & Blindness(2015)

    2015

  28. [36]

    Chiarello Filippo, Giordano Vito, Spada Irene, Barandoni Simone, and Fantoni Gualtiero. 2024. Future applications of generative large language models: A data-driven case study on ChatGPT.Technovation(2024)

    2024

  29. [37]

    Jason Ford and Hala Strohmier Berry. 2024. Feasibility of Machine Learning- Enhanced Detection for QR Code Images in Email-based Threats. InIEEE Cyber A wareness and Research Symposium

    2024

  30. [38]

    Joel Frank, Franziska Herbert, Jonas Ricker, Lea Schönherr, Thorsten Eisenhofer, Asja Fischer, Markus Dürmuth, and Thorsten Holz. 2024. A representative study on human detection of artificially generated media across countries. InS&P

    2024

  31. [39]

    Thomas D Gauthier. 2001. Detecting trends using Spearman’s rank correlation coefficient.Environmental forensics(2001)

    2001

  32. [40]

    William J Gordon, Adam Wright, Ranjit Aiyagari, Leslie Corbo, Robert J Glynn, et al. 2019. Assessment of employee susceptibility to phishing attacks at US health care institutions.JAMA network open(2019)

    2019

  33. [41]

    Kristen K Greene, Michelle Steves, Mary Theofanos, Jennifer Kostick, et al. 2018. User context: an explanatory variable in phishing susceptibility. InUSEC

    2018

  34. [42]

    Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2024. Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text. InForty-first International Conference on Machine Learni...

    2024

  35. [44]

    Julian Hazell. 2023. Spear phishing with large language models.arXiv preprint arXiv:2305.06972(2023)

    2023 arXiv

  36. [45]

    Fred Heiding, Simon Lermen, Andrew Kao, Bruce Schneier, and Arun Vish- wanath. 2024. Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects. arXiv:2412.00586(2024)

    2024 arXiv

  37. [46]

    Fredrik Heiding, Bruce Schneier, Arun Vishwanath, Jeremy Bernstein, and Peter S Park. 2024. Devising and detecting phishing emails using large language models.IEEE Access(2024)

    2024

  38. [47]

    Doron Hillman, Yaniv Harel, and Eran Toch. 2023. Evaluating organizational phishing awareness training on an enterprise scale.Comp. Secur.(2023)

    2023

  39. [48]

    Grant Ho, Ariana Mirian, Elisa Luo, Khang Tong, Euyhyun Lee, et al . 2025. Understanding the Efficacy of Phishing Training in Practice. InIEEE S&P

    2025

  40. [49]

    Markus Jakobsson. 2018. Two-factor inauthentication–the rise in SMS phishing attacks.Computer Fraud & Security(2018)

    2018

  41. [50]

    Francisco Jáñez-Martino, Rocío Alaiz-Rodríguez, Víctor González-Castro, Ed- uardo Fidalgo, and Enrique Alegre. 2023. A review of spam email detection: analysis of spammer strategies and the dataset shift problem.Artificial Intelli- gence Review(2023)

    2023

  42. [51]

    Matthew L Jensen, Michael Dinger, Ryan T Wright, and Jason Bennett Thatcher

  43. [52]

    Prasanna Kansakar, Arslan Munir, and Neda Shabani. 2019. Technology in the hospitality industry: Prospects and challenges.IEEE Consumer Electronics Magazine(2019)

    2019

  44. [53]

    Rabimba Karanjai. 2022. Targeted phishing campaigns using large scale language models.arXiv:2301.00665(2022)

    2022 arXiv

  45. [54]

    Doowon Kim, Haehyun Cho, Yonghwi Kwon, Adam Doupé, Sooel Son, Gail-Joon Ahn, and Tudor Dumitras. 2021. Security analysis on practices of certificate authorities in the HTTPS phishing ecosystem. InACM AsiaCCS

    2021

  46. [55]

    Michael Koddebusch. 2022. Exposing the phish: the effect of persuasion tech- niques in phishing e-mails. InAnnual International Conference on Digital Gov- ernment Research

    2022

  47. [56]

    Tadayoshi Kohno, Yasemin Acar, and Wulf Loh. 2023. Ethical frameworks and computer security trolley problems: Foundations for conversations. InUSENIX Sec. 13 ASIA CCS ’25, August 25–29, 2025, Hanoi, Vietnam Marie Weinz, Nicola Zannone, Luca Allodi, and Giovanni Apruzzese

    2023

  48. [57]

    Takashi Koide, Naoki Fukushi, Hiroki Nakano, and Daiki Chiba. 2023. PhishRepli- cant: A Language Model-based Approach to Detect Generated Squatting Domain Names. InACSAC

    2023

  49. [58]

    Katharina Krombholz, Peter Frühwirt, Peter Kieseberg, Ioannis Kapsalis, Markus Huber, and Edgar Weippl. 2014. QR code security: A survey of attacks and challenges for usable security. InHAS (part of HCI International). Springer

    2014

  50. [59]

    Daniele Lain, Tarek Jost, Sinisa Matetic, Kari Kostiainen, and Srdjan Capkun

  51. [60]

    Daniele Lain, Kari Kostiainen, and Srdjan Čapkun. 2022. Phishing in organiza- tions: Findings from a large-scale and long-term study. InS&P

    2022

  52. [61]

    Tyson Langford and Bryson Payne. 2023. Phishing faster: Implementing chatgpt into phishing campaigns. InFuture Technologies Conference

    2023

  53. [62]

    Jehyun Lee, Farren Tang, Pingxiao Ye, Fahim Abbasi, Phil Hay, and Dinil Mon Divakaran. 2021. D-fence: A flexible, efficient, and comprehensive phishing email detection system. InIEEE EuroS&P

    2021

  54. [63]

    Tian Lin, Daniel E Capecci, Donovan M Ellis, Harold A Rocha, Sandeep Dom- maraju, Daniela S Oliveira, and Natalie C Ebner. 2019. Susceptibility to spear- phishing emails: Effects of internet user demographics and email content.ACM Transactions on Computer-Human Interaction (TO...

    2019

  55. [64]

    M Lokesh, A Keerthi Devi, U Dinesh Chowdary, PVNS Divya Lakshmi, and G Rama Koteswara Rao. 2023. Data Redundancy, Data Phishing, and Data Cloud Backup. InIEEE ICECCT

    2023

  56. [65]

    Charalampos Manifavas, Konstantinos Fysarakis, Konstantinos Rantos, and George Hatzivasilis. 2014. DSAPE–dynamic security awareness program evalu- ation. InHAS (part of HCI International). Springer

    2014

  57. [66]

    2021.Intro- duction to linear regression analysis

    Douglas C Montgomery, Elizabeth A Peck, and G Geoffrey Vining. 2021.Intro- duction to linear regression analysis. John Wiley & Sons

    2021

  58. [67]

    Santana N Morris. 2023. Cultural diversity in workplace and the role of man- agement.American Journal of Industrial and Business Management(2023)

    2023

  59. [68]

    Aleksandr Nahapetyan, Sathvik Prasad, Kevin Childs, Adam Oest, Yeganeh Ladwig, Alexandros Kapravelos, and Bradley Reaves. 2024. On sms phishing tactics and infrastructure. InIEEE Symposium on Security and Privacy

    2024

  60. [69]

    Geoff Norman. 2010. Likert scales, levels of measurement and the “laws” of statistics.Advances in health sciences education(2010)

    2010

  61. [70]

    Adam Oest, Yeganeh Safaei, Penghui Zhang, Brad Wardman, Kevin Tyers, Yan Shoshitaishvili, and Adam Doupé. 2020. PhishTime : Continuous longitudinal measurement of the effectiveness of anti-phishing blacklists. InUSENIX Security

    2020

  62. [71]

    Justin Petelka, Yixin Zou, and Florian Schaub. 2019. Put your warning where your link is: Improving and evaluating email phishing warnings. InACM CHI

    2019

  63. [72]

    Iasonas Polakis, Georgios Kontaxis, Spiros Antonatos, Eleni Gessiou, Thanasis Petsas, and Evangelos P Markatos. 2010. Using social networks to harvest email addresses. InACM WPES

    2010

  64. [73]

    Rana Pourmohamad, Steven Wirsz, Adam Oest, Tiffany Bao, Yan Shoshitaishvili, et al. 2024. Deep Dive into Client-Side Anti-Phishing: A Longitudinal Study Bridging Academia and Industry. InAsiaCCS

    2024

  65. [74]

    Ward Priestman, Tony Anstis, Isabel G Sebire, Shankar Sridharan, and Neil J Sebire. 2019. Phishing in healthcare organisations: Threats, mitigation and approaches.BMJ Health & Care Informatics(2019)

    2019

  66. [75]

    Ahmad Sahban Rafsanjani, Norshaliza Binti Kamaruddin, Hazlifah Mohd Rusli, and Mohammad Dabbagh. 2023. Qsecr: Secure qr code scanner according to a novel malicious url detection framework.IEEE Access(2023)

    2023

  67. [76]

    Rakesh Rana and Richa Singhal. 2015. Chi-square test and its application in hypothesis testing.Journal of Primary Care Specialties(2015)

    2015

  68. [77]

    Konstantinos Rantos, Konstantinos Fysarakis, and Charalampos Manifavas. 2012. How effective is your security awareness program? An evaluation methodology. Information Security Journal: A Global Perspective(2012)

    2012

  69. [78]

    Benjamin Reinheimer, Lukas Aldag, Peter Mayer, Mattia Mossano, Reyhan Duezguen, Bettina Lofthouse, Tatiana Von Landesberger, and Melanie Volkamer

  70. [79]

    Sayak Saha Roy, Poojitha Thota, Krishna Vamsi Naragam, and Shirin Nilizadeh

  71. [80]

    Said Salloum, Tarek Gaber, Sunil Vadera, and Khaled Shaalan. 2021. Phish- ing email detection using natural language processing techniques: a literature survey.Procedia Computer Science189 (2021)

    2021

  72. [81]

    Francesco Salvi, Manoel Horta Ribeiro, Riccardo Gallotti, and Robert West. 2024. On the conversational persuasiveness of large language models: A randomized controlled trial.Nature Human Behaviour(2024)

    2024

  73. [82]

    Orvila Sarker, Asangi Jayatilaka, Sherif Haggag, Chelsea Liu, and M Ali Babar

  74. [83]

    Dawn M Sarno and Mark B Neider. 2022. So many phish, so little time: Exploring email task factors and phishing susceptibility.Human Factors(2022)

    2022

  75. [84]

    InIEEE S&P

    From Chatbots to Phishbots?: Phishing Scam Generation in Commercial Large Language Models. InIEEE S&P

  76. [85]

    Philipp Schoenegger, Indre Tuminauskaite, Peter S Park, Rafael Valdece Sousa Bastos, and Philip E Tetlock. 2024. Wisdom of the silicon crowd: LLM ensemble prediction capabilities rival human crowd accuracy.Science Advances(2024)

    2024

  77. [86]

    Paul G Schrader and Kimberly A Lawless. 2004. The knowledge, attitudes, & behaviors approach how to evaluate performance and learning in complex environments.Performance Improvement(2004)

    2004

  78. [87]

    Anderson, et al

    Saskia Laura Schröer, Giovanni Apruzzese, Human Soheil, Pavel Laskov, Hyrum S. Anderson, et al . 2025. SoK: On the Offensive Potential of AI. In IEEE SaTML

    2025

  79. [88]

    Systems and Software(2024)

    A Multi-vocal Literature Review on challenges and critical success factors of phishing education, training and awareness.J. Systems and Software(2024)

    2024

  80. [89]

    Filipo Sharevski, Amy Devine, Emma Pieroni, and Peter Jachim. 2022. Phishing with malicious QR codes. InEuroUSEC

    2022

  81. [90]

    It’s like when a child reaches onto the hot hob

    Katharina Schiller, Florian Adamsky, Christian Eichenmüller, Matthias Reimert, and Zinaida Benenson. 2024. Employees’ Attitudes towards Phishing Simula- tions:“It’s like when a child reaches onto the hot hob”. InACM CCS

    2024

  82. [91]

    Hossein Siadati, Sean Palka, Avi Siegel, and Damon McCoy. 2017. Measuring the effectiveness of embedded phishing exercises. InUSENIX CSET 17

    2017

  83. [92]

    2023.The State of Phishing

    Slashnext. 2023.The State of Phishing. Technical Report. Slashnext. https: //slashnext.com/wp-content/uploads/2023/10/SlashNext-The-State-of - Phishing-Report-2023.pdf

    2023

  84. [93]

    Stephanie Stacey. 2025. AI-generated phishing scams target corporate executives. Financial Times(2025). https://www.ft.com/content/d60fb4fb-cb85-4df7-b246- ec3d08260e6f

    2025

  85. [94]

    Donald J Schuirmann. 1987. A comparison of the two one-sided tests procedure and the power approach for assessing the equivalence of average bioavailability. Journal of pharmacokinetics and biopharmaceutics(1987)

    1987

  86. [95]

    Karthika Subramani, William Melicher, Oleksii Starov, Phani Vadrevu, and Roberto Perdisci. 2022. PhishInPatterns: measuring elicited user interactions at scale on phishing websites. InACM Internet Measurement Conference

    2022

  87. [96]

    Filipo Sharevski, Mattia Mossano, Maxime Fabian Veit, Gunther Schiefer, and Melanie Volkamer. 2024. Exploring Phishing Threats through QR Codes in Naturalistic Settings. InUSEC

    2024

  88. [97]

    Saranya Vaithilingam and Santhosh Aradhya Mohan Shankar. 2024. Enhancing Security in QR Code Technology Using AI: Exploration and Mitigation Strategies. International Journal of Intelligence Science(2024)

    2024

  89. [98]

    Rohit Valecha, Pranali Mandaokar, and H Raghav Rao. 2021. Phishing email detection using persuasion cues.IEEE TDSC(2021)

    2021

  90. [99]

    Suresh Veluru, Yogachandran Rahulamathavan, P Viswanath, Paul Longley, and Muttukrishnan Rajarajan. 2013. E-mail Address Categorization based on Semantics of Surnames. InIEEE CIDM

    2013

  91. [100]

    Michelle Steves, Kristen Greene, and Mary Theofanos. 2020. Categorizing human phishing difficulty: a Phish Scale.Journal of Cybersecurity(2020)

    2020

  92. [101]

    Emma J Williams, Joanne Hinds, and Adam N Joinson. 2018. Exploring suscep- tibility to phishing in the workplace.Int. J. Human-Computer Studies(2018)

    2018

  93. [102]

    Zhibo Sun, Faris Bugra Kokulu, Penghui Zhang, Adam Oest, Gianluca Stringhini, et al. 2024. From Victims to Defenders: An Exploration of the Phishing Attack Reporting Ecosystem. InRAID

    2024

  94. [103]

    Rundong Yang, Kangfeng Zheng, Bin Wu, Di Li, Zhe Wang, and Xiujuan Wang

  95. [104]

    Ezer Osei Yeboah-Boateng and Priscilla Mateko Amanor. 2014. Phishing, SMiSh- ing & Vishing: an assessment of threats against mobile devices.Journal of Emerging Trends in Computing and Information Sciences(2014)

    2014

  96. [105]

    William Yeoh, He Huang, Wang-Sheng Lee, Fadi Al Jafari, and Rachel Mansson

  97. [106]

    Thomas Weber, Maximilian Brandmaier, Albrecht Schmidt, and Sven Mayer

  98. [107]

    Significant Productivity Gains through Programming with Large Language Models.Proceedings of the ACM on Human-Computer Interaction(2024)

    2024

  99. [108]

    Microsoft login

    Tianyi Zhang, Faisal Ladhak, Esin Durmus, Percy Liang, Kathleen McKeown, and Tatsunori B Hashimoto. 2024. Benchmarking large language models for news summarization.T. of the Association for Computational Linguistics(2024). Appendix A Technical details (and challenges) We expan...

    2024

  100. [109]

    Emma J Williams and Danielle Polage. 2019. How persuasive is phishing email? The role of authentic design, influence and current events in email judgements. Behaviour & Information Technology(2019)

    2019

  101. [114]

    Simulated phishing attack and embedded training campaign.Journal of Computer Information Systems(2022)

    2022

  102. [115]

    Kelvin SC Yong, Kang Leng Chiew, and Choon Lin Tan. 2019. A survey of the QR code phishing: the current attacks and countermeasures. InIEEE ICSCC

    2019

  103. [116]

    Ying Yuan, Qingying Hao, Giovanni Apruzzese, Mauro Conti, and Gang Wang

  104. [117]

    Are Adversarial Phishing Webpages a Threat in Reality?

    "Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users’ Perception of Adversarial Webpages. InTheWebConf

  105. [2017]

    Journal of Management Information Systems(2017)

    Training to mitigate phishing attacks using mindfulness techniques. Journal of Management Information Systems(2017)

    2017

  106. [2020]

    An investigation of phishing awareness and education over time: When and how to best remind users. InSOUPS

  107. [2022]

    Predicting User Susceptibility to Phishing Based on Multidimensional Features.Computational Intelligence and Neuroscience(2022)

    2022

  108. [2023]

    Early LLM-based Tools for Enterprise Information Workers Likely Provide Meaningful Boosts to Productivity.Microsoft Research(2023)

    2023

  109. [2024]

    InACM CCS

    Content, Nudges and Incentives: A Study on the Effectiveness and Per- ception of Embedded Phishing Training. InACM CCS

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.