Spotlight on AI-Based Hybrid Phishing Detection Strategies: A Systematic Review

Phishing attacks have continued to increase globally over the past several decades and remain a major entry point for multi-vector cyberattacks. As conventional single-method detection techniques often struggle to identify increasingly sophisticated phishing attempts, researchers have increasingly focused on AI-based hybrid detection approaches. This systematic review, conducted in accordance with the PRISMA 2020 statement, provides a focused synthesis of these approaches. A comprehensive search was conducted across seven academic databases and one scholarly search engine. Three reviewers independently screened the records, extracted the data, and conducted the methodological quality assessment, with disagreements resolved through discussion and consensus. Following a multi-stage screening process, 18 peer-reviewed studies published between January 2020 and June 2026 were included. The methodological quality of each study was evaluated using a structured quality-assessment checklist. The included studies were synthesized narratively with emphasis on hybridization techniques, data modalities, model architectures, evaluation metrics, strengths, limitations, and future research directions. The findings indicate that AI-based hybrid approaches generally achieved strong benchmark performance and improved robustness against the phishing scenarios evaluated within the included studies. However, limitations were identified in relation to explainability, generalizability, computational complexity, and real-time deployment. The review also identified continuing challenges involving the trade-off between accuracy and efficiency, dependence on unimodal or benchmark datasets, limited reproducibility reporting, and insufficient real-world validation. Future research should prioritize lightweight and fairness-aware hybrid architectures, multimodal data integration, continual learning, and stronger model interpretability to support reliable and scalable deployment in real-world environments.