PhishLumos: From a Single URL to Campaign-Level Phishing Mitigation

Phishing campaigns increasingly evade automated scanners through cloaking and selective blocking, which prevents page retrieval and forces URL-by-URL triage. We present PhishLumos, a campaign-level mitigation system that starts from a single seed URL and treats evasion as a pivot signal. When content is missing, deceptive, or inaccessible, PhishLumos pivots to infrastructure evidence, including shared domains, IP addresses, certificates, and historical scan metadata. It consolidates observations into a typed property graph knowledge base with a deterministic, idempotent merge operator and provenance for auditable investigations. A supervisor agent coordinates specialized agents and synthesis agents powered by large language models to profile campaigns and generate empirically validated detection rules for deployment in existing controls. On 103 real-world campaigns (6,020 URLs), PhishLumos achieved a median campaign coverage of 100% and a median detection lead time of 192.8 hours (8.0 days) before expert verification, with a 0.1% false positive rate on 1,000 benign URLs. In a six-month in-the-wild study starting from 600 challenging seed URLs, the generated rules uncovered 192,407 additional URLs; 92.0% were later flagged as malicious by at least one engine in a multi-engine scanning service. Quantitative comparisons against four baselines, including a state-of-the-art LLM-based content classifier, show that under content inaccessibility any content-conditional method (LLM or otherwise) is bounded at 0.341 recall, whereas PhishLumos reaches 0.994 F1 by pivoting to infrastructure evidence.