A recent phishing campaign used a flaw in Robinhood’s email system to send highly convincing fake login alerts to users.
Quick Summary – TLDR:
- Cybercriminals exploited a flaw in Robinhood account creation flow.
- Phishing emails were sent from official Robinhood email addresses.
- Attackers injected malicious links into system generated emails.
- No user funds or personal data were directly compromised.
What Happened?
Robinhood confirmed that attackers abused a vulnerability in its account creation process, allowing phishing emails to be sent from its official systems. The issue was quickly addressed, and the company stated that no customer accounts or funds were impacted.
New Robinhood phishing chain that’s kinda beautiful:
— Abdel (@rockkdev) April 27, 2026
1. Attacker creates an RH account using the Gmail dot trick of your email (same inbox, different address)
2. Sets device name to HTML
3. RH’s “unrecognized activity” email renders the device name unsanitized (html injection)… pic.twitter.com/IUOLNxQjC7
How the Phishing Attack Worked?
The phishing campaign stood out because the emails appeared completely legitimate. They were sent from the official address noreply@robinhood.com and carried the subject line “Your recent login to Robinhood.”
This made them highly convincing, even to experienced users.
Here is how attackers pulled it off:
- Hackers created new Robinhood accounts using manipulated email formats, especially Gmail variations using the dot trick.
- Gmail ignores dots in usernames, but Robinhood treated each variation as a unique account.
- During account creation, attackers injected malicious HTML code into the device name field.
- Robinhood’s system failed to sanitize this field before including it in automated emails.
As a result, the system unknowingly sent out real emails containing fake content, including a clickable “Review Activity Now” button that redirected users to phishing websites.
Why the Emails Looked So Real?
Unlike typical phishing attempts, these emails passed all standard authentication checks such as SPF and DKIM. That is because they were generated by Robinhood’s own infrastructure.
This gave attackers a major advantage:
- Emails landed directly in inboxes instead of spam folders.
- Branding and formatting matched real Robinhood alerts.
- Messages included realistic login details such as device type and location.
Some emails even mentioned login attempts from devices like iPhone 17 Pro, adding another layer of urgency and believability.
What Happened If Users Clicked?
Users who clicked the malicious link were redirected to fake login pages designed to steal credentials.
These pages often asked for:
- Username and password.
- Two factor authentication codes.
With this information, attackers could potentially gain full access to user accounts.
However, Robinhood clarified that its multi layered security systems, including two factor authentication, device approvals, and biometric verification, helped reduce the risk of direct account takeovers.
Company Response and Fix
Robinhood responded quickly once the issue surfaced. The company issued warnings to users, asking them to delete suspicious emails and avoid clicking on unknown links.
The company also stated:
On Sunday evening, some customers received a falsified email from noreply@robinhood.com with the subject line “Your recent login to Robinhood.”
— Robinhood Help (@AskRobinhood) April 27, 2026
This phishing attempt was made possible by an abuse of the account creation flow. It was not a breach of our systems or customer…
Further steps taken include:
- Fixing the vulnerability in the account creation process.
- Taking down phishing infrastructure used in the attack.
- Strengthening input validation to prevent similar exploits.
Affected users were also directly notified.
Possible Source of Target Emails
Experts believe attackers may have used email lists from previous data breaches, including the 2021 Robinhood breach, where millions of user details were exposed.
Alternatively, attackers may have relied on guessed or externally sourced email addresses to distribute the phishing emails at scale.
SQ Magazine Takeaway
I think this incident shows how dangerous modern phishing attacks have become. When attackers can use a company’s own system to send emails, it breaks the basic trust users rely on. Even careful users can get tricked in situations like this.
What stands out to me is not just the vulnerability, but how simple it was. A missing input check turned into a large scale phishing campaign. That is a reminder that even small security gaps can create serious risks.
The good part is that Robinhood acted fast and confirmed that no funds or personal data were directly affected. But this is a strong warning for users to always double check links, even when emails look completely real.
