Online trading platform Robinhood recently faced a phishing campaign in which cybercriminals manipulated its account creation process to send fake security alerts through legitimate company emails. The incident caused confusion among users, as the fraudulent messages appeared to come directly from Robinhood’s official email system.
The phishing emails carried the subject line “Your recent login to Robinhood” and warned recipients about an “Unrecognized Device Linked to Your Account.” The messages included suspicious IP addresses and partially hidden phone numbers to create a sense of urgency and authenticity.
"We detected a login attempt from a device that is not recognized," reads the phishing email. "If this was not you, please review your account activity immediately to secure your account."
Recipients were directed to click a button labeled “Review Activity Now,” which redirected users to a phishing domain designed to steal login credentials. The malicious site has since been taken offline, though screenshots shared on Reddit suggested it was being used to capture Robinhood account details.
What made the attack particularly convincing was that the emails originated from Robinhood’s legitimate email address, noreply@robinhood.com
, and successfully passed SPF and DKIM authentication checks commonly used to verify email legitimacy.
According to findings by BleepingComputer, attackers exploited a weakness in Robinhood’s onboarding workflow that failed to properly sanitize HTML input during account registration.
During the signup process, Robinhood automatically sends a “Your recent login to Robinhood” notification containing information such as device details, IP address, login time, and approximate location. Threat actors reportedly manipulated the device metadata field by inserting malicious HTML code, which was later rendered inside the email.
This caused the “Device” section of the message to display a fake warning about suspicious account activity, effectively embedding a phishing alert into a legitimate email template.
Researchers believe the attackers may have used previously leaked customer email lists to target existing Robinhood users. In 2021, Robinhood experienced a breach that affected nearly 7 million customers, with stolen information later appearing for sale on hacking forums.
The attackers also reportedly took advantage of Gmail’s dot aliasing feature, which allows email addresses with added periods to still route to the same inbox. This method enabled cybercriminals to create multiple Robinhood accounts using slight variations of real customer email addresses while ensuring delivery to the intended victims.
As a result, many recipients received what looked like a genuine Robinhood login notification containing a fraudulent warning about “unrecognized activity” and instructions to review their accounts immediately.
Robinhood later addressed the incident publicly on X.
"On Sunday evening, some customers received a falsified email from noreply@robinhood.com
with the subject line 'Your recent login to Robinhood.'," posted RobinHood.
"This phishing attempt was made possible by an abuse of the account creation flow. It was not a breach of our systems or customer accounts, and personal information and funds were not impacted."
The company has since resolved the vulnerability by removing the abused Device field from account creation emails. Robinhood also advised affected users to delete the suspicious email and avoid interacting with any embedded links.