Hackers Exploit Robinhood System for Phishing Emails

Hackers targeted Robinhood customers over the weekend with highly convincing phishing emails sent through the brokerage's own notification system, prompting warnings from cybersecurity experts and a swift response from the company.

The fraudulent messages, which mimicked legitimate security alerts about unrecognized account activity, appeared to originate from [email protected]. They passed standard email authentication checks, including SPF, DKIM, and DMARC, and even threaded into existing conversations with prior Robinhood notifications in some inboxes, such as Gmail. Recipients saw personalized details like login times, device information, and case numbers, along with a "Review Activity" button that linked to a malicious site at tinzio.net via googletagmanager.com, designed to steal login credentials and two-factor authentication codes.

Security researcher Abdel Sabbah detailed the exploit, explaining that attackers exploited a Gmail "dot trick," where variations like security.robinhood.com route to the same inbox despite dots, which Robinhood's system does not normalize. The hackers then created an account using the altered address and set the device name to unsanitized...