PhishRewrite: a benchmark for LLM-driven evasion of phishing detectors

PhishRewrite is a benchmark and code artifact for measuring how content-based phishing/spam detectors degrade when phishing text is rewritten by a large language model to read as benign while preserving the malicious ask. Contents: (1) emails.csv — 28,201 labelled emails (phishing from the Nazario corpus; ham from SpamAssassin and Enron) under a unified schema; (2) rewrites.csv — 4,000 LLM rewrites of held-out phishing emails at four severities (light paraphrase → full rewrite preserving only the call-to-action), generated with Claude Haiku 4.5 and Google Gemini 2.5 Flash; (3) the verbatim severity prompts, provenance, licences, and a refang script. All URLs are defanged (http→hxxp, https→hxxps, www.→www[.]), scheme-only and losslessly — reverse with the included refang.py to recompute URL features. The headline result is the detector recall/PR-AUC degradation curve versus rewrite severity, with a URL-masked ablation and a same-era external-validity replication on CEAS-2008. Intended use: defensive security research and detector hardening only. Prohibited: sending email, real phishing or social-engineering, or deployment against people or live systems. Derived entirely from public named research corpora; no PII collection, no live scraping, no email sending. See ETHICS.md and LIMITATIONS.md in the archive. Code: https://github.com/gaurangkatyal/phishrewrite (MIT). Data: CC-BY-4.0; upstream corpus terms documented in PROVENANCE.md.