Robinhood Account-Creation Flaw Abused to Send Phishing Emails
Summary
Attackers abused Robinhood’s account-creation flow to send authentic-looking login alerts containing phishing links. Robinhood said its systems and customer accounts were not breached and no personal information or funds were affected.
Key points
- Attackers created Robinhood accounts using modified Gmail usernames that Gmail treats as equivalent but Robinhood treats as distinct.
- They inserted malicious HTML containing phishing links into account device-name fields.
- Robinhood’s legitimate login-notification emails rendered the unsanitized HTML, and the messages passed email authentication checks.
- Robinhood said the incident was not a breach of its systems or customer accounts, and personal information and funds were not impacted.
- The article says attackers may have used addresses from Robinhood’s 2021 breach, or externally sourced or guessed Gmail addresses.
Article Details
- Victim Organization
- Robinhood
- Incident Type
- Phishing campaign enabled by abuse of Robinhood's account creation flow. Attackers inserted malicious HTML containing phishing links into device-name fields, which was rendered in login notification emails.
- Operational Impact
- Users received convincing phishing emails sent through Robinhood's notification system. Robinhood said its systems and customer accounts were not breached, and personal information and funds were not impacted.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
Products
GmailExperts who analyzed the phishing emails said the attackers created new Robinhood accounts using modified versions of existing Gmail addresses via the so-called ‘dot trick’.RobinhoodInvesting and trading platform Robinhood has confirmed that cybercriminals exploited a vulnerability in its account creation process to send out legitimate-looking phishing emails.