Robinhood account creation flaw exploited for phishing emails

As reported by Bleeping Computer, threat actors exploited Robinhood's account creation process to send convincing phishing emails to users, making them believe their accounts were compromised.

Attackers abused a flaw in Robinhood's onboarding process, allowing them to inject HTML into account confirmation emails. This manipulated the emails to appear as legitimate login alerts, warning of unrecognized device activity. The phishing emails originated from Robinhood's official [email protected] address and passed security checks, making them highly deceptive. The emails directed users to a now-defunct phishing site, likely intended to steal credentials.

Attackers may have used customer email lists from a previous 2021 data breach and Gmail's dot aliasing to target users. Robinhood confirmed the incident, stating it was an abuse of the account creation flow and not a breach of customer accounts or personal information. The company has since fixed the vulnerability by removing the abused field from their emails and advises users to delete any suspicious messages.

Source: Bleeping Computer