Pith. sign in

REVIEW 4 major objections 4 minor 62 references

Can We End the Cat-and-Mouse Game? Simulating Self-Evolving Phishing Attacks with LLMs and Genetic Algorithms

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper contends that breeding phishing strategies as natural-language prompts, with a simulated victim's click likelihood as the fitness signal, makes attacks evolve past one-shot LLM generation and keeps them ahead of adaptive…

desk verdict A genuinely new LLM+GA phishing simulation whose headline results are measured with the same model that is being optimized; the framework is worth engaging, but the 'inherent asymmetry' claim needs human validation and repeated runs. read the letter →

arxiv 2507.21538 v1 pith:NYIETSKN submitted 2025-07-29 cs.CR

Seiji Sato , Tetsushi Ohki , Masakatsu Nishigaki This is my paper
classification cs.CR
keywords phishingsimulationgeneticalgorithmlargelanguagemodelssocialengineeringco-evolutionpsychologicalmanipulationcybersecurityattackstrategyevolution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that phishing attacks can be studied as an evolving population. The authors represent an attack as a natural-language strategy prompt, score each strategy by how likely an LLM-simulated victim says it is to click a link, and use a genetic algorithm to recombine and mutate the strongest strategies over thirty generations. They report three results: evolved strategies become more psychologically sophisticated and outscore one-shot LLM-generated attacks; a victim's prior phishing knowledge changes which tactics survive; and when the simulated victim's knowledge is updated from the attacks it has seen, click likelihood drops and then recovers, producing a cat-and-mouse oscillation. The authors read this as evidence of an inherent asymmetry in which attackers keep refining while a single defender's knowledge tends to converge on generic guidance. If the simulation reflects real human susceptibility, it offers a cheap, scalable way to anticipate future social-engineering tactics.

What carries the argument

The central object is the attack strategy viewed as a natural-language prompt: instead of evolving final messages, the genetic algorithm evolves the instructions that produce messages, which keeps the psychological mechanism interpretable. Fitness is the average victim click-likelihood score, exponentially scaled as $1.4^v$ so that differences at the high end of the 1-10 scale still matter; the victim evaluates each message independently with chain-of-thought reasoning. The genetic operators are elitist copy, LLM-mediated crossover of two parent strategies, and mutation that injects a randomly selected psychological theory from a fixed list of 250 social-psychology theories, effects, and cognitive biases, asking the LLM to adapt the strategy around it. In the co-evolution experiments, the victim's prior knowledge is periodically rewritten from the ten highest-scoring messages, giving defense a single updating knowledge base face to face with fifteen evolving attacker strategies.

What would settle it

Run a controlled human study in which participants make a simulated click decision on the actual epoch-1 and epoch-30 phishing messages, or compare human responses with the LLM victim's 1-10 scores on the same messages. If humans are not more likely to click the evolved messages, or if the LLM's ranking of messages disagrees with human choices, the central claim about evolving persuasion fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that evolutionary search over LLM-generated text prompts produces measurably more persuasive phishing messages than one-shot generation. Starting from strategies generated only from pre-trained knowledge, the median strategy's visit likelihood rises from about 4.6 at epoch 1 to 7.0 at epoch 30 on a 1-10 scale, and the top-performing strategies shift from direct urgency and curiosity toward personalization, value alignment, social proof, and intimacy-building. When the victim carries real-world awareness guidance or a list of known psychological techniques, the average likelihood rises more slowly but still trends upward, and the surviving strategies avoid the exact markers the victim was taught. In the co-evolution condition the victim's prior knowledge is rebuilt each epoch from the ten most effective messages; click likelihood falls sharply after the first update, recovers, falls again around epoch 17, and rises again, while the attack strategies' embeddings diverge and the victim's knowledge embedding converges. The paper concludes that attackers continuously refine their methods while defenders struggle to cover all evolving threats.

Load-bearing premise

The load-bearing premise is that the LLM playing the victim, when prompted with chain-of-thought and prior-knowledge context, gives click-likelihood scores that track how real humans would actually respond; every reported trend inherits that premise.

Editorial extensions

If this is right

  • Simulated phishing strategies improve over generations, so one-shot LLM-generated attacks are not a reliable ceiling for forecasting future social-engineering tactics.
  • Awareness training that teaches fixed markers such as urgency, authority, and scarcity can be circumvented; evolved attacks shift to subtler principles such as rapport and social proof.
  • Adaptive defense updates can temporarily lower attack success, but the simulated attacker recovers, so static guidelines are insufficient and defenses need to co-evolve.
  • The method gives a scalable, low-cost testbed for ranking candidate defenses against attacks that have not appeared in training data.
  • The reported asymmetry means defenders should expect a single set of heuristics to lag behind a population of attackers that only needs one successful message.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If LLM victim ratings faithfully track human susceptibility, the same evolutionary loop could be run in reverse to breed defensive heuristics or training content, selecting for messages that lower click likelihood rather than raise it.
  • The apparent attacker advantage may be partly a representational asymmetry: one victim knowledge base competes against a population of fifteen strategies; a defense that itself evolved a diverse set of heuristics might close the gap.
  • Because mutation only samples from a fixed list of 250 known psychological theories, the search explores combinations of documented principles rather than genuinely unprecedented manipulation; novel tactics outside that list would not emerge.
  • A direct human validation study comparing click behavior on epoch-1 and epoch-30 messages would settle whether the reported trends are evidence about phishing or artefacts of the LLM's own preferences.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a framework that combines LLM-based phishing message generation with a genetic algorithm over natural-language attack strategies, evaluated by an LLM playing the victim. Experiments with Llama 3.1 8B over 30 epochs report that (RQ1) attack strategies become more effective and sophisticated, (RQ2) victim awareness shapes the evolved strategies, and (RQ3) co-evolution produces a cat-and-mouse dynamic with an 'inherent asymmetry' favoring attackers. The main methodological contributions are the use of psychological theories as mutation operators and the explicit simulation of victim knowledge updates.

Significance. If the LLM judge were a valid proxy for human susceptibility, the framework would be a scalable, low-cost way to generate hypotheses about how phishing strategies adapt and to test defensive training material. The paper is transparent about its prompts and settings, and the evolutionary mechanism is clearly described. However, the current evidence supports only the claim that the genetic algorithm optimizes the score produced by the same model family used to generate the attacks; the externally interesting claims about real phishing effectiveness and defender/attacker asymmetry require validation with human raters or at least an independent judge, together with repeated runs.

major comments (4)
  1. [Section 3.2 Step 4 and Section 4.1] The sole fitness signal is the visit-likelihood score from an Llama 3.1 8B prompt, and the same model family (Llama 3.1 8B) generates the strategies, messages, mutations, and prior-knowledge updates. This creates a closed loop: the genetic algorithm is rewarded for satisfying the preferences of the very model it is optimizing against. The abstract and conclusion claim that attacks 'surpass naive LLM-generated attacks' and that an 'inherent asymmetry' exists, but Section 6.2 concedes that 'real-world validation is necessary for conclusive evidence.' The paper should either provide human-subject validation or an independent-model judge, or restrict its claims to effectiveness as judged by the simulated LLM victim. The 'sophistication' summaries in Sections 4.2 and 4.3 are also produced by the same LLM, so they are not independent evidence of psychological sophistication.
  2. [Figures 3, 5, 6, 7 and Section 4.1] All reported trajectories are from single runs with no error bars, no repeated seeds, and no statistical tests. Because the paper acknowledges in Section 6.1 that both the genetic algorithm and LLM generation are stochastic, the 'steady increase' in Figures 3, 5, and 6 and the epoch-17 drop in Figure 7 cannot be distinguished from run-to-run variation. Please add multiple independent runs with variance reporting and, where appropriate, significance tests.
  3. [Section 4.2, RQ1 baseline] Comparing epoch 30 with epoch 1 is partly circular as a test of the framework because epoch 1 is the initial population that the genetic algorithm is explicitly optimizing. The statement that evolved strategies 'surpass naive LLM-generated attacks' is satisfied by construction if 'naive' means the initial population. A fair baseline would be multiple independent one-shot LLM samples without evolutionary selection, or a held-out judge not used during optimization.
  4. [Section 4.4, RQ3] The 'inherent asymmetry' conclusion is derived from the simulation design in which the attacker is a population of 15 strategies while the victim holds a single prior-knowledge text, and from cosine distances between embeddings without variance or significance analysis. The observed asymmetry may be an artifact of the asymmetry in representation, not an empirical property of real attacker-defender dynamics. Please either analyze the sensitivity of the claim to population size and knowledge-update design, or temper the conclusion to the specific simulation conditions.
minor comments (4)
  1. [Section 3.2 Step 6 and Section 4.4] The two sections describe different procedures for updating prior knowledge: Step 6 feeds the top 10 messages, while Section 4.4 states that an LLM first summarizes the psychological techniques before updating the prior knowledge. Please clarify which procedure was actually used.
  2. [Section 4.1] The model name is written inconsistently as 'LLaMA 3.1 8B' in Section 4.1 and 'Llama 3.1 8B' elsewhere; please standardize.
  3. [Section 4.1] The paper does not report the LLM sampling temperature or the random seed used for the genetic algorithm, which are essential for reproducibility given the stochasticity acknowledged in Section 6.1.
  4. [Figure 4] The UMAP projection is presented without a legend or an interpretation of the clusters; please add both so that the reader can assess the claimed semantic shift in strategy embeddings.

Circularity Check

2 steps flagged · score 7.0 of 10

The headline claims of rising effectiveness and an attacker-favoring asymmetry are outputs of the same fitness function and simulation design that define them.

  1. fitted input called prediction [Section 3.2, Steps 4-5; Section 4.2 (RQ1)]
    "Upon receiving a phishing message, the victim evaluates its likelihood of inducing a URL click. We prompt the LLM, acting as the victim, to rate the likelihood of clicking on the link using a scale from 1 (Not likely at all) to 10 (Very likely). ... For each attack strategy, we compute an effectiveness score based on the average visit likelihood of the phishing messages it generates. This score serves as the fitness value in our genetic algorithm."

    The only signal used to evolve strategies is the average visit likelihood assigned by the victim LLM, and the only evidence offered for 'increasingly effective' strategies is that same average visit likelihood (Figure 3). Roulette-wheel selection with elitism is designed to raise this score; reporting its rise as 'surpassing naive LLM-generated attacks' is reporting the optimizer's objective back as a result. The term 'effectiveness' is not independently measured, so the RQ1 claim holds by construction with respect to the LLM judge. The paper's own Section 6.2 concedes that 'real-world validation is necessary for conclusive evidence.'

  2. self definitional [Section 4.4 (RQ3); abstract and conclusion]
    "This divergence can be attributed to the inherent asymmetry in our model. The victim’s prior knowledge is singular and must encompass a wide range of attack strategies, which limits its capacity for variation. Conversely, the attacker employs multiple strategies that are subject to genetic algorithm operations, allowing for a high degree of freedom and continual evolution."

    The conclusion that adversarial interactions reveal an 'inherent asymmetry' restates the simulation's construction: one victim knowledge text updated from the top-10 scored messages versus 15 attacker strategies recombined by genetic operators. The paper itself labels this an 'inherent asymmetry in our model,' so the cat-and-mouse divergence and the defender's convergence to a stable guideline are built into Step 6's update rule, not emergent evidence about real attacker-defender dynamics.

full rationale

The core derivation chain is: (i) the victim LLM's 1-10 click-likelihood rating is the definition of attack effectiveness; (ii) the genetic algorithm's fitness is exactly that rating; (iii) Figure 3's upward trend is therefore the optimizer's objective, not an independent observation. Similarly, the RQ3 cat-and-mouse asymmetry is not discovered but imposed by Step 6, which gives the defender a single summarizing knowledge text while the attacker explores a population of 15 strategies. No self-citation is load-bearing, and the paper is honest in Section 6.2 that LLM-as-victim accuracy 'remains a subject of debate' and that 'real-world validation is necessary,' but the abstract and conclusion do not carry that hedge. Because the central empirical claims reduce to properties of the fitness loop, the circularity score is 7 rather than 0-2.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claims rest on hand-chosen simulation constants and on the unvalidated premise that LLM ratings approximate human responses. The GA deterministically increases its own fitness function, so the free parameters and the victim-model axiom jointly shape every reported trend. No new physical or formal entities are introduced.

free parameters (7)
  • Population size = 15 strategies per generation
    Hand-chosen in Section 4.1; no sensitivity analysis is provided.
  • Number of generations (epochs) = 30
    Hand-chosen; all evolution trends are reported over this fixed horizon with no convergence analysis.
  • Phishing messages per strategy = 3
    Section 3.2 Step 2 says multiple messages are generated to mitigate variance, but the number 3 is not justified and affects fitness estimate noise.
  • Fitness exponent base = 1.4
    Section 3.2 Step 5 introduces 1.4^v as an ad hoc exponential scaling to amplify selection differences; no principled derivation is given.
  • Elite/crossover/mutation split = 3/9/3
    Section 4.1 lists these tunable genetic algorithm parameters; no ablation or sensitivity study is performed.
  • Top messages used to update victim knowledge = 10
    Section 3.2 Step 6 chooses 10 deliberately to avoid overwhelming the LLM; no sensitivity check is provided.
  • Mutation theory pool = 250 Wikipedia psychological concepts
    Section 3.3 samples from a predefined set drawn from Wikipedia lists; the exact list is not shipped, making this an uncontrolled input.
assumptions (6)
  • domain assumption The LLM victim's chain-of-thought likelihood rating is a valid proxy for real human phishing susceptibility.
    Section 3.2 Step 4 and Section 6.2; all effectiveness results and the GA fitness depend on this. The authors cite conflicting evidence [9,26] versus [12,36] and provide no human validation.
  • domain assumption The average visit likelihood is an appropriate fitness function for phishing strategy effectiveness.
    Section 3.2 Step 5; this score is the sole selection pressure, so all evolutionary trends inherit it.
  • ad hoc to paper Epoch 1 strategies constitute a fair baseline for 'naive LLM-generated attacks'.
    Section 4.2 uses epoch 1 as baseline; these are outputs of the same prompt pipeline that later generations optimize, so the comparison is not independent.
  • domain assumption LLM-generated summaries of the top 10 messages model how a human defender updates knowledge.
    Section 3.2 Step 6 and RQ3; the updated defense is also evaluated by the same LLM, so the co-evolution loop is self-referential.
  • standard math UMAP projection preserves semantic relationships between strategy embeddings.
    Section 4.2 Figure 4; used to support diversification claims, with hyperparameters not reported.
  • ad hoc to paper Random sampling from the Wikipedia psychological lists exposes a sufficiently broad mutation space.
    Section 3.3 Mutation; the pool is not shipped and the mutation effect is not ablated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Can We End the Cat-and-Mouse Game? Simulating Self-Evolving Phishing Attacks with LLMs and Genetic Algorithms." pith.science (2026). https://pith.science/paper/NYIETSKN

@misc{pith2026250721538,
  author       = {Pith},
  title        = {Pith review of: Can We End the Cat-and-Mouse Game? Simulating Self-Evolving Phishing Attacks with LLMs and Genetic Algorithms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NYIETSKN}},
  note         = {Machine review of arXiv:2507.21538}
}
read the original abstract

Anticipating emerging attack methodologies is crucial for proactive cybersecurity. Recent advances in Large Language Models (LLMs) have enabled the automated generation of phishing messages and accelerated research into potential attack techniques. However, predicting future threats remains challenging due to reliance on existing training data. To address this limitation, we propose a novel framework that integrates LLM-based phishing attack simulations with a genetic algorithm in a psychological context, enabling phishing strategies to evolve dynamically through adversarial interactions with simulated victims. Through simulations using Llama 3.1, we demonstrate that (1) self-evolving phishing strategies employ increasingly sophisticated psychological manipulation techniques, surpassing naive LLM-generated attacks, (2) variations in a victim's prior knowledge significantly influence the evolution of attack strategies, and (3) adversarial interactions between evolving attacks and adaptive defenses create a cat-and-mouse dynamic, revealing an inherent asymmetry in cybersecurity -- attackers continuously refine their methods, whereas defenders struggle to comprehensively counter all evolving threats. Our approach provides a scalable, cost-effective method for analyzing the evolution of phishing strategies and defenses, offering insights into future social engineering threats and underscoring the necessity of proactive cybersecurity measures.

Figures

Figures reproduced from arXiv: 2507.21538 by the authors.

Figure 1
Figure 1. Overall procedure of our methodology scores, which determine the selection of parent strategies for genetic operations. Copy (Elitism) To maintain stability in the evolutionary process, a subset of the highest-scoring attack strategies is di￾rectly copied to the next generation without modification. This elitism mechanism ensures that the most effective strategies persist across generations, preventing the genetic a… view at source ↗
Figure 3
Figure 3. Evolution of average visit likelihood (without vic [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Embeddings of attack strategies (without victim’s [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Evolution of average visit likelihood (Scenario 2: [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 7
Figure 7. Figure 7: Evolution of average visit likelihood (Prior knowl [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: Cosine distance of prior knowledge embeddings [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

62 extracted references · 53 canonical work pages

  1. [1]

    Next-generation phishing: How llm agents empower cyber attackers

    Khalifa Afane, Wenqi Wei, Ying Mao, Junaid Farooq, and Juntao Chen. Next-generation phishing: How llm agents empower cyber attackers. In 2024 IEEE Interna- tional Conference on Big Data (BigData), pages 2558–

    work page 2024

  2. [2]

    Harness- ing large language models to simulate realistic human responses to social engineering attacks: A case study

    Mohammad Asfour and Juan Carlos Murillo. Harness- ing large language models to simulate realistic human responses to social engineering attacks: A case study. International Journal of Cybersecurity Intelligence & Cybercrime, 6(2):21–49, 2023

    work page 2023

  3. [3]

    Tasks people prompt: A tax- onomy of llm downstream tasks in software verifi- cation and falsification approaches

    Víctor A Braberman, Flavia Bonomo-Braberman, Yian- nis Charalambous, Juan G Colonna, Lucas C Cordeiro, and Rosiane de Freitas. Tasks people prompt: A tax- onomy of llm downstream tasks in software verifi- cation and falsification approaches. arXiv preprint arXiv:2404.09384, 2024

    work page arXiv 2024

  4. [4]

    Enhancing ge- netic improvement mutations using large language mod- els

    Alexander EI Brownlee, James Callan, Karine Even- Mendoza, Alina Geiger, Carol Hanna, Justyna Petke, Federica Sarro, and Dominik Sobania. Enhancing ge- netic improvement mutations using large language mod- els. In International Symposium on Search Based Soft- ware Engineering, pages 153–159. Springer, 2023

    work page 2023

  5. [5]

    A literature review on classification of phishing attacks

    S Chanti and T Chithralekha. A literature review on classification of phishing attacks. International Journal 12 of Advanced Technology and Engineering Exploration, 9(89):446–476, 2022

    work page 2022

  6. [6]

    Chatgpt’s security risks and benefits: offensive and defensive use-cases, mitigation measures, and future implications

    Maha Charfeddine, Habib M Kammoun, Bechir Ham- daoui, and Mohsen Guizani. Chatgpt’s security risks and benefits: offensive and defensive use-cases, mitigation measures, and future implications. IEEE Access, 2024

    work page 2024

  7. [7]

    Adapting to cyber threats: A phishing evolu- tion network (pen) framework for phishing generation and analyzing evolution patterns using large language models

    Fengchao Chen, Tingmin Wu, Van Nguyen, Shuo Wang, Hongsheng Hu, Alsharif Abuadbba, and Carsten Rudolph. Adapting to cyber threats: A phishing evolu- tion network (pen) framework for phishing generation and analyzing evolution patterns using large language models. arXiv preprint arXiv:2411.11389, 2024

    arXiv 2024

  8. [8]

    {PentestGPT}: Evaluating and harnessing large language models for automated penetration testing

    Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. {PentestGPT}: Evaluating and harnessing large language models for automated penetration testing. In 33rd USENIX Security Sympo- sium (USENIX Security 24), pages 847–864, 2024

    work page 2024

Show all 62 references
  1. [9]

    Can ai language models replace human participants? Trends in Cognitive Sciences, 27(7):597–600, 2023

    Danica Dillion, Niket Tandon, Yuling Gu, and Kurt Gray. Can ai language models replace human participants? Trends in Cognitive Sciences, 27(7):597–600, 2023

    2023

  2. [10]

    Teams of llm agents can exploit zero- day vulnerabilities

    Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Teams of llm agents can exploit zero- day vulnerabilities. arXiv preprint arXiv:2406.01637, 2024

    2024 arXiv

  3. [11]

    Connecting large language models with evolutionary algorithms yields powerful prompt optimizers

    Qingyan Guo, Rui Wang, Junliang Guo, Bei Li, Kaitao Song, Xu Tan, Guoqing Liu, Jiang Bian, and Yujiu Yang. Connecting large language models with evolutionary algorithms yields powerful prompt optimizers. arXiv preprint arXiv:2309.08532, 2023

    2023 arXiv

  4. [12]

    Ai language models cannot replace human research participants

    Jacqueline Harding, William D’Alessandro, NG Laskowski, and Robert Long. Ai language models cannot replace human research participants. Ai & Society, 39(5):2603–2605, 2024

    2024

  5. [13]

    Spear phishing with large language mod- els

    Julian Hazell. Spear phishing with large language mod- els. arXiv preprint arXiv:2305.06972, 2023

    2023 arXiv

  6. [14]

    Devising and de- tecting phishing emails using large language models

    Fredrik Heiding, Bruce Schneier, Arun Vishwanath, Jeremy Bernstein, and Peter S Park. Devising and de- tecting phishing emails using large language models. IEEE Access, 2024

    2024

  7. [15]

    On the humanity of con- versational ai: Evaluating the psychological portrayal of llms

    Jen-tse Huang, Wenxuan Wang, Eric John Li, Man Ho Lam, Shujie Ren, Youliang Yuan, Wenxiang Jiao, Zhaopeng Tu, and Michael Lyu. On the humanity of con- versational ai: Evaluating the psychological portrayal of llms. In The Twelfth International Conference on Learning Representa...

    2023

  8. [16]

    Towards automating social engineering using social networking sites

    Markus Huber, Stewart Kowalski, Marcus Nohlberg, and Simon Tjoa. Towards automating social engineering using social networking sites. In 2009 International Conference on Computational Science and Engineering, volume 3, pages 117–124. IEEE, 2009

    2009

  9. [17]

    Towards ai-powered cybersecurity attack modeling with simulation tools: Re- view of attack simulators

    Aws Jaber and Lothar Fritsch. Towards ai-powered cybersecurity attack modeling with simulation tools: Re- view of attack simulators. In International Conference on P2P , Parallel, Grid, Cloud and Internet Computing, pages 249–257. Springer, 2022

    2022

  10. [18]

    Simu- lation for cybersecurity: state of the art and future direc- tions

    Hamdi Kavak, Jose J Padilla, Daniele Vernon-Bido, Saikou Y Diallo, Ross Gore, and Sachin Shetty. Simu- lation for cybersecurity: state of the art and future direc- tions. Journal of Cybersecurity, 7(1):tyab005, 2021

    2021

  11. [19]

    Exploring the frontiers of llms in psychological ap- plications: A comprehensive review

    Luoma Ke, Song Tong, Peng Cheng, and Kaiping Peng. Exploring the frontiers of llms in psychological ap- plications: A comprehensive review. arXiv preprint arXiv:2401.01519, 2024

    2024 arXiv

  12. [20]

    Chat- phishdetector: Detecting phishing sites using large lan- guage models

    Takashi Koide, Hiroki Nakano, and Daiki Chiba. Chat- phishdetector: Detecting phishing sites using large lan- guage models. IEEE Access, 2024

    2024

  13. [21]

    Honeybot, your man in the middle for automated social engineering

    Tobias Lauinger, Veikko Pankakoski, Davide Balzarotti, and Engin Kirda. Honeybot, your man in the middle for automated social engineering. In LEET, pages 1–8, 2010

    2010

  14. [22]

    Internet-based social engineering psychology, at- tacks, and defenses: A survey

    Theodore Tangie Longtchi, Rosana Montañez Ro- driguez, Laith Al-Shawaf, Adham Atyabi, and Shouhuai Xu. Internet-based social engineering psychology, at- tacks, and defenses: A survey. Proceedings of the IEEE, 2024

    2024

  15. [23]

    Genera- tive ai misuse: A taxonomy of tactics and insights from real-world data

    Nahema Marchal, Rachel Xu, Rasmi Elasmar, Iason Gabriel, Beth Goldberg, and William Isaac. Genera- tive ai misuse: A taxonomy of tactics and insights from real-world data. arXiv preprint arXiv:2406.13843, 2024

    2024 arXiv

  16. [24]

    Harnessing gpt-4 for generation of cybersecurity grc policies: A focus on ransomware attack mitigation.Com- puters & security, 134:103424, 2023

    Timothy McIntosh, Tong Liu, Teo Susnjak, Hooman Alavizadeh, Alex Ng, Raza Nowrozy, and Paul Watters. Harnessing gpt-4 for generation of cybersecurity grc policies: A focus on ransomware attack mitigation.Com- puters & security, 134:103424, 2023

    2023

  17. [25]

    Mirascope

    Mirascope. Mirascope. https://mirascope.com/,

  18. [26]

    Large language models can outperform humans in social situational judgments

    Justin M Mittelstädt, Julia Maier, Panja Goerke, Frank Zinn, and Michael Hermes. Large language models can outperform humans in social situational judgments. Scientific Reports, 14(1):27449, 2024

    2024

  19. [27]

    Human cognition through the lens of social engineering cyberattacks

    Rosana Montañez, Edward Golob, and Shouhuai Xu. Human cognition through the lens of social engineering cyberattacks. Frontiers in psychology, 11:1755, 2020. 13

    2020

  20. [28]

    Social engineering attack framework

    Francois Mouton, Mercia M Malan, Louise Leenen, and Hein S Venter. Social engineering attack framework. In 2014 Information Security for South Africa, pages 1–9. IEEE, 2014

    2014

  21. [29]

    Prompted contextual vectors for spear-phishing detection

    Daniel Nahmias, Gal Engelberg, Dan Klein, and Asaf Shabtai. Prompted contextual vectors for spear-phishing detection. arXiv preprint arXiv:2402.08309, 2024

    2024 arXiv

  22. [30]

    Phishing: Spot and report scam emails, texts, websites and calls

    National Cyber Security Centre. Phishing: Spot and report scam emails, texts, websites and calls. https://www.ncsc.gov.uk/collection/ phishing-scams/spot-scams, 2021. Accessed: 2025-02-05

    2021

  23. [31]

    Ollama. Ollama. https://ollama.com/, 2025. Ac- cessed: 2025-02-05

    2025

  24. [32]

    Applying large language model (llm) for developing cybersecurity poli- cies to counteract spear phishing attacks on senior cor- porate managers

    Thomas Quinn and Olivia Thompson. Applying large language model (llm) for developing cybersecurity poli- cies to counteract spear phishing attacks on senior cor- porate managers. 2024

    2024

  25. [33]

    Weaponizing data sci- ence for social engineering: Automated e2e spear phish- ing on twitter

    John Seymour and Philip Tully. Weaponizing data sci- ence for social engineering: Automated e2e spear phish- ing on twitter. Black Hat USA, 37:1–39, 2016

    2016

  26. [34]

    Social engineering attacks prevention: A systematic lit- erature review

    Wenni Syafitri, Zarina Shukur, Umi Asma’Mokhtar, Rossilawati Sulaiman, and Muhammad Azwan Ibrahim. Social engineering attacks prevention: A systematic lit- erature review. IEEE access, 10:39325–39343, 2022

    2022

  27. [35]

    Psychological profiling in cybersecurity: A look at llms and psycholinguistic features

    Jean Marie Tshimula, D’Jeff K Nkashama, Jean Tshibangu Muabila, René Manassé Galekwa, Hugues Kanda, Maximilien V Dialufuma, Mbuyi Muk- endi Didier, Kalonji Kalala, Serge Mundele, Pa- tience Kinshie Lenye, et al. Psychological profiling in cybersecurity: A look at llms and psyc...

    2024 arXiv

  28. [36]

    Large language models cannot replace human participants because they cannot portray identity groups

    Angelina Wang, Jamie Morgenstern, and John P Dick- erson. Large language models cannot replace human participants because they cannot portray identity groups. arXiv preprint arXiv:2402.01908, 2024

    2024 arXiv

  29. [37]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information pro- cessing systems, 35:24824–24837, 2022

    2022

  30. [38]

    List of psychological ef- fects — Wikipedia, the free encyclopedia

    Wikipedia contributors. List of psychological ef- fects — Wikipedia, the free encyclopedia. https: //en.wikipedia.org/w/index.php?title=List_ of_psychological_effects&oldid=1254715116,

  31. [39]

    List of social psychol- ogy theories — Wikipedia, the free encyclopedia

    Wikipedia contributors. List of social psychol- ogy theories — Wikipedia, the free encyclopedia. https://en.wikipedia.org/w/index.php?title= List_of_social_psychology_theories&oldid= 1202707650, 2024. Accessed: 2025-02-05

    2024

  32. [41]

    Autoattacker: A large language model guided system to implement automatic cyber-attacks

    Jiacen Xu, Jack W Stokes, Geoff McDonald, Xuesong Bai, David Marshall, Siyue Wang, Adith Swaminathan, and Zhou Li. Autoattacker: A large language model guided system to implement automatic cyber-attacks. arXiv preprint arXiv:2403.01038, 2024

    2024 arXiv

  33. [42]

    List of cognitive bi- ases — Wikipedia, the free encyclopedia

    Wikipedia contributors. List of cognitive bi- ases — Wikipedia, the free encyclopedia. https://en.wikipedia.org/w/index.php?title= List_of_cognitive_biases&oldid=1272835005,

  34. [43]

    Cyber-physical power system (cpps): A review on modeling, simulation, and analysis with cyber security applications

    Rajaa Vikhram Yohanandhan, Rajvikram Madurai Elavarasan, Premkumar Manoharan, and Lucian Mihet- Popa. Cyber-physical power system (cpps): A review on modeling, simulation, and analysis with cyber security applications. IEEE Access, 8:151019–151064, 2020

    2020

  35. [44]

    {LLM-Fuzzer}: Scaling assessment of large language model jailbreaks

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. {LLM-Fuzzer}: Scaling assessment of large language model jailbreaks. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4657–4674, 2024

    2024

  36. [45]

    Contemplating social engineering stud- ies and attack scenarios: A review study

    Affan Yasin, Rubia Fatima, Lin Liu, Awaid Yasin, and Jianmin Wang. Contemplating social engineering stud- ies and attack scenarios: A review study. Security and Privacy, 2(4):e73, 2019

    2019

  37. [48]

    Your thought process behind the decision

    Jiahao Yu, Yangguang Shao, Hanwen Miao, Junzheng Shi, and Xinyu Xing. Promptfuzz: Harnessing fuzzing techniques for robust testing of prompt injection in llms. arXiv preprint arXiv:2409.14729, 2024. 14 Appendix A Prompt Templates in Methodology (Section 3) Generating Initial A...

    2024 arXiv

  38. [49]

    Persuasion: Uses psychological triggers to influence behavior and encourage compliance with a request

  39. [50]

    Pretexting: Creates a fabricated scenario to gain a victim’s trust and increase engagement

  40. [51]

    Impersonation: Assumes a false identity to manipulate a victim into compliance

  41. [52]

    Visual Deception: Repurposes benign visual elements to mislead victims into trusting false information

  42. [53]

    Incentive and Motivator: Uses rewards, either external or internal, to drive a desired action

  43. [54]

    Urgency: Pressures victims into quick decision-making by creating a false sense of time constraint

  44. [55]

    Attention Grabbing: Uses sensory stimuli to divert focus and increase susceptibility to deception

  45. [56]

    Personalization: Tailors messages using personal details to enhance credibility and trust

  46. [57]

    Contextualization: Establishes commonality with the victim to build trust and increase compliance

  47. [58]

    Quid Pro Quo: Offers something desirable in exchange for compliance with a risky action

  48. [59]

    Foot-in-the-Door: Gains compliance for larger requests by first securing agreement to smaller ones

  49. [60]

    Trusted Relationship: Exploits existing trust in a person or service to manipulate the victim

  50. [61]

    Affection Trust: Develops an emotional bond with the victim to lower defenses and increase compliance

  51. [62]

    Decoy Effect: Creates an illusion of a good deal to manipulate decision-making and encourage risk-taking

  52. [63]

    Priming: Gradually influences decision-making by exposing the victim to biased information over time

  53. [64]

    check out,

    Loss Aversion: Exploits a victim’s fear of losing something valuable to manipulate their choices. B.3 Evaluation (RQ3) Principles in Epoch 2 **Principle 1: Spark Curiosity** * Pique users’ interest by asking questions, highlighting unique benefits, or referencing their recent ...

  54. [2025]

    Accessed: 2025-02-05

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.