• Fardeen Jamshed Shaikh
• Nirbhay Singh

Phishing attacks have become increasingly elusive and polymorphic, targeting blind spots in legacy defensive measures and techniques of cloaking and infrastructure-level obfuscation. In practice, this means that many state-of-the-art approaches operate with either single agent-single modality analysis (i.e., URL lexical features or URL/DOM inspection) or shallow ensemble or deep learning classifiers with poor interpretability or insufficient contextualization for Security Operations Center (SOC) triage. In this paper, we present PhishDec: a modular multi-agents artificial intelligence (AI) architecture for phishing detection, multi-vector evidence analysis, and security incident response. PhishDec operates by splitting the task of analyzing potential phishing resources along several evidentiary domains (URL mechanics, DOM/HTML, brand visual identity, and content semantics), with each domain being explored by a dedicated specialist AI agent providing structured findings. An adaptive consensus mechanism then evaluates and combines the results from these domains, with its operation differing fundamentally from prior multi-agent methods in that it enables coordinated debate-style reasoning between dissimilar and potentially conflicting evidence domains. In addition, PhishDec integrates model-level feature attribution and Large Language Model (LLM)-aided reasoning to produce both human-explained findings and structured mitigation and response recommendations, including but not limited to the inference of multi-vector attack graph from a single seed URL for the SOC to prioritize response. We find that the proposed architecture is capable of operating on both phishing-related datasets and unknown campaigns, demonstrating its utility in an operational SOC environment. In this work, we focus on the performance of the evidentiary and architectural aspects of the system, evaluating the architecture’s performance on detection, false positives, adaptability to emerging attacks, and the quality of generated triage artifacts.

Phishing Detection, Multi-Agent AI, Explainable AI, Large Language Models, Cybersecurity, Threat Intelligence, Multi-Vector Analysis, Feature Engineering, Adaptive Consensus, Incident Response, SOC Triage, Infrastructure Analysis, Zero-Day Detection, Cloaking Detection.

"PhishDec: A Modular Multi-Agent AI Architecture for Autonomous Phishing Detection and Incident Triage", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 9, page no.b849-b858, September-2026, Available :http://www.jetir.org/papers/JETIR2609196.pdf

"PhishDec: A Modular Multi-Agent AI Architecture for Autonomous Phishing Detection and Incident Triage", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 9, page no. ppb849-b858, September-2026, Available at : http://www.jetir.org/papers/JETIR2609196.pdf