Hackers Use Robinhood Email Pipeline for Authenticated Phishing Emails

Hackers used Robinhood’s own notification pipeline to send phishing emails that appeared to come from [email protected] and passed standard email authentication checks. Gmail routed some of the messages into the same threads as legitimate Robinhood security alerts. The exploit combined Gmail’s dotted-address behavior with unsanitized HTML in a Robinhood email template, according to security researcher Abdel Sabbah.