Modern email spam and phishing attacks have evolved far beyond keyword
blacklists or simple heuristics. Adversaries now craft multi-modal campaigns
that combine natural-language text with obfuscated URLs, forged headers, and
malicious attachments, adapting their strategies within days to bypass filters.
Traditional spam detection systems, which rely on static rules or
single-modality models, struggle to integrate heterogeneous signals or to
continuously adapt, leading to rapid performance degradation.
We propose EvoMail, a self-evolving cognitive agent framework for robust
detection of spam and phishing. EvoMail first constructs a unified
heterogeneous email graph that fuses textual content, metadata (headers,
senders, domains), and embedded resources (URLs, attachments). A Cognitive
Graph Neural Network enhanced by a Large Language Model (LLM) performs
context-aware reasoning across these sources to identify coordinated spam
campaigns. Most critically, EvoMail engages in an adversarial self-evolution
loop: a ''red-team'' agent generates novel evasion tactics -- such as character
obfuscation or AI-generated phishing text -- while the ''blue-team'' detector
learns from failures, compresses experiences into a memory module, and reuses
them for future reasoning.
Extensive experiments on real-world datasets (Enron-Spam, Ling-Spam,
SpamAssassin, and TREC) and synthetic adversarial variants demonstrate that
EvoMail consistently outperforms state-of-the-art baselines in detection
accuracy, adaptability to evolving spam tactics, and interpretability of
reasoning traces. These results highlight EvoMail's potential as a resilient
and explainable defense framework against next-generation spam and phishing
threats.