Abstract

The explosive growth in the amount of the Internet of Things (IoT) devices at 18.5 billion has revolutionized industries such as smart homes, healthcare, and industrial systems by allowing them to operate seamlessly and automating their functionality. However, this expansion comes at the great cost of increased cyber-attack surface, with phishing becoming a major threat through the use of deceptive URLs, smishing, vishing, and spoofed interfaces, with reports seeing more than 820,000 daily IoT attacks in the year 2025. Although machine learning (ML) and deep learning (DL) have improved phishing detection, current approaches are often limited in resource-constrained IoT environments. This review aims to deeply discuss state-of-the-art intelligent and explainable phishing detection systems developed for IoT, focusing on the use of hybrid DL models, explainable AI (XAI) methods, and novel strategies towards improved accuracy, explainability and efficiency on constrained devices. We analyze major methods, including CNN-LSTM hybrids, SHAP/LIME explanations, LLM-based interpretability, federated learning for privacy, and multimodal integration to deal with different types of attacks by systematically reviewing over 30 studies released in 2023–2025. Major findings include that XAI-enhanced systems achieve 93–99% accuracy, can better detect complex patterns than traditional ML, and can offer hybrid solutions which better manage resource usage and are more resilient to adversarial threats. These developments have significant implications for the construction of trustworthy IoT cybersecurity, such as supporting regulatory requirements, increasing user awareness, and providing a more robust defense for vital infrastructures in the face of more sophisticated phishing threats.