Security researchers discovered a critical vulnerability in Robinhood’s email system on April 27, 2026, that allowed attackers to send legitimate-looking security alerts containing phishing links from Robinhood’s own infrastructure.The emails passed every major authentication check and appeared completely genuine.
- Robinhood’s email system transmits legitimate security alerts containing malicious phishing links from its official domain.
- Attackers exploit Robinhood’s server logic using Gmail dot tricks to bypass DKIM and SPF authentication on April 27, 2026.
- The vulnerability enables massive phishing campaigns because authenticated emails deceive even security-conscious users and automated spam filters.
How the Attack Works
The attack combines two techniques:
1. Gmail Dot Trick
Attackers register a Robinhood account using a variation of a victim’s Gmail address (e.g., firstname.lastname@gmail.com instead of firstnamelastname@gmail.com). Gmail routes both to the same inbox, but Robinhood treats them as separate accounts.
2. HTML Injection in Security Emails
The attacker sets the “device name” on the fake account to malicious HTML code containing a phishing link. When Robinhood sends an “unrecognized activity” alert, it inserts the device name without sanitization.
CTO at Cubby Law and former Edge Security Engineer at Vercel, first publicly documented the full attack chain: “Attacker creates an RH account using the Gmail dot trick of your email (same inbox, different address). Then sets device name to HTML. RH’s ‘unrecognized activity’ email renders the device name unsanitized (html injection). The result is a real email from noreply@robinhood.com, DKIM pass, SPF pass, DMARC pass, with a phishing CTA.”
Genuine News Deserves Honest Attention.
High-conviction projects require an intelligent audience. Connect with readers who value sharp reporting.
👉 Submit Your PRReal-World Impact
By Monday, CryptoVonDoom (@CryptoVonDoom), co-founder of CMNDLine and GMI.gg, shared his experience after receiving one: “The email really freaked me out since I viewed the raw source and checked the DKIM, SPF and DMARC — all checked out as legit. I did notice a dot in the wrong spot of that particular email address which definitely seemed off.”
The emails originate from Robinhood’s legitimate noreply@robinhood.com address, making them extremely convincing.Robinhood’s Response
As of April 27, 2026, Robinhood had not issued an official public statement on the vulnerability.
Robinhood’s Official Response
Robinhood addressed the incident via its official support account (@AskRobinhood):“On Sunday evening, some customers received a falsified email from noreply@robinhood.com with the subject line ‘Your recent login to Robinhood.’
This phishing attempt was made possible by an abuse of the account creation flow. It was not a breach of our systems or customer accounts, and personal information and funds were not impacted.
If you received this email, please delete it and do not click any suspicious links. If you have clicked a suspicious link or have any questions about your account, please contact us directly within the Robinhood app or website.”
David Schwartz (@JoelKatz), CTO of Ripple, also issued a strong public warning: “WARNING: Any emails you get that appear to be from Robinhood (and may actually be from their email system) are phishing attempts.”
Chain Street’s Take
This attack breaks every trust signal users were taught to rely on. The sender is real. The authentication headers all pass. The only clue is often just a misplaced dot in the email address.
Robinhood’s failure to sanitize user-controlled fields in automated emails is a basic security oversight with serious consequences. Email authentication standards were built to stop spoofing not to protect against a platform unwittingly sending malicious content from its own domain.
Every fintech platform that sends automated alerts should now be auditing their email rendering logic. The next attack won’t use the Gmail dot trick. It will use something else and the authentication checks will still pass.
Activate Intelligence Layer
Institutional-grade structural analysis for this article.
