Ethereum has revolutionized digital finance by enabling decentralized finance (DeFi) through smart contracts and peer-to-peer transactions. Despite these advancements, the rapid growth of Ethereum has exposed users to significant risks from phishing attacks. Traditional detection methods focus on surface-level transaction data, leading to insufficient analysis of phishing attack, and struggle with the computational challenges posed by the vast and continuously expanding Ethereum transaction graph. To address these limitations, we propose Ghaos, an innovative framework designed to enhance phishing detection on Ethereum. Ghaos integrates Long Short-Term Memory networks to extract detailed features from opcode sequences within smart contracts, allowing for a deeper analysis of internal transaction logic. These extracted features are then utilized by GraphSAGE (Graph Sample and Aggregate) combined with Attention to construct a robust detection model. Additionally, Ghaos employs the Louvain algorithm to partition the transaction graph into smaller, more manageable subgraphs, significantly reducing computational demands and optimizing resource utilization. Experimental evaluations demonstrate that Ghaos outperforms existing detection methods, achieving a precision of 0.6984, recall of 0.7693, and an F1 score of 0.7321, highlighting the framework’s efficacy in accurately identifying phishing attacks while maintaining computational efficiency.