Attackers Abused Robinhood Account Emails to Send Phishing Alerts
Summary
Attackers injected HTML into Robinhood account-creation emails to send convincing phishing alerts linking to robinhood[.]casevaultreview[.]com. Robinhood removed the vulnerable Device field and said customer accounts and data were not breached.
Key points
- Attackers used unsanitized device metadata to inject HTML into Robinhood account-creation emails.
- The messages came from Robinhood’s legitimate [email protected] address and passed SPF and DKIM checks.
- A “Review Activity Now” button linked to robinhood[.]casevaultreview[.]com, which screenshots suggest was intended to harvest credentials; the site is now down.
- Attackers likely used previously breached email lists and Gmail dot aliasing to reach Robinhood customers.
- Robinhood confirmed abuse of its account-creation flow, removed the Device field, and advised recipients to delete the messages.
- Robinhood said its systems and customer accounts were not breached and that personal information and funds were not affected.
Article Details
- Victim Organization
- Robinhood
- Victim Domain
- robinhood.com
- Incident Type
- Phishing enabled by an account-creation flaw that allowed attackers to inject HTML into legitimate Robinhood emails.
- Operational Impact
- Some customers received falsified phishing emails. Robinhood said its systems and customer accounts were not breached and personal information and funds were not impacted. Robinhood removed the abused Device field; the phishing site was reported down.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | robinhood[.]casevaultreview[.]com | Phishing site linked from the injected email; screenshots indicated it was likely used to harvest Robinhood credentials. |
MITRE ATT&CK
Products
Gmaillink led to a phishing site (robinhood.casevaultreview.com), attackers used breached email lists and Gmail dot aliasing to target real customers, and Robinhood has removed the vulnerable Device field and advisedRobinhoodThreat actors exploited a flaw in Robinhood’s account creation emails to inject HTML that rendered convincing “Unrecognized Device” phishing alerts inside legitimate [email protected] messages.