SMS Phishing (also known as 'smishing') is a growing deceptive social engineering (SE) attack that leverages mobile SMS to conduct cybercrimes such as stealing sensitive information or spreading malware by tricking users into interacting with attackers' messages (e.g., responding to or clicking URLs). This threat has increased rapidly in recent years, causing $470M in financial losses for United States users in 2024 alone. This threat is also evolving rapidly, meaning that attackers continually adapt their tactics, reshaping the landscape. There is a significant body of literature on investigating smishing attacks and defenses. However, there is no systematic review that reflects the current attack and defense landscape along with available resources (i.e., relevant datasets). This motivates us to systematize the current smishing research efforts, including the following four research pillars: (a) user perception and susceptibility, (b) attack characterization, (c) defense landscape, and (d) smishing datasets. This leads us to propose novel future research directions towards effectively mitigating smishing attacks.

翻译：短信网络钓鱼（又称"smishing"）是一种日益增长的欺骗性社会工程（SE）攻击，利用移动短信实施网络犯罪，例如通过诱骗用户与攻击者信息交互（如回复信息或点击统一资源定位符）来窃取敏感信息或传播恶意软件。该威胁近年来迅速加剧，仅2024年就给美国用户造成4.7亿美元的经济损失。该威胁也在快速演变，攻击者不断调整策略，重塑攻防态势。学界已有大量文献研究短信网络钓鱼攻击与防御，但尚未出现能够反映当前攻防态势及可用资源（如相关数据集）的系统综述。这促使我们系统梳理当前短信网络钓鱼研究，涵盖以下四大研究支柱：（a）用户认知与易感性，（b）攻击特征刻画，（c）防御态势，（d）短信网络钓鱼数据集。基于此，我们提出能有效缓解短信网络钓鱼攻击的创新性未来研究方向。