Loading story…
Attackers abused Robinhood’s account-creation workflow to inject malicious HTML into an unsanitized device-name metadata field, causing phishing content to appear inside legitimate "Your recent login to Robinhood" notifications sent from noreply@robinhood.com. The emails warned of an "Unrecognized Device Linked to Your Account" and directed recipients to a credential-harvesting domain, robinhood[.]casevaultreview[.]com, while still passing SPF and DKIM checks because the messages were generated by Robinhood’s own systems.
The campaign appears to have targeted known Robinhood users, potentially using email addresses exposed in the company’s 2021 breach and Gmail dot-aliasing to route manipulated signup notifications to intended victims. Robinhood said the incident was an abuse of its signup flow rather than a breach of its systems or customer accounts, added that personal information and funds were not impacted, and said it has fixed the issue by removing the vulnerable device field from account-creation emails; the company advised recipients to delete the message, avoid clicking links, and contact support only through the official app or website.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Robinhood stated the activity was an abuse of its account creation flow rather than a breach of its systems or customer accounts, and said personal information and funds were not impacted. The company fixed the flaw by removing the abused device field from account creation emails and advised recipients to delete the message and avoid clicking links.
Threat actors exploited Robinhood's account creation workflow by injecting malicious HTML into an unsanitized device metadata field, causing phishing content and a credential-stealing link to appear inside legitimate login notification emails sent from noreply@robinhood.com. The campaign likely targeted Robinhood users using email addresses exposed in the company's 2021 breach and Gmail dot aliasing to route the manipulated emails to intended victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Robin Banks** is a phishing-as-a-service platform selling turnkey phishing kits aimed at financial institutions and user credentials in the **United States, United Kingdom, Canada, and Australia**. IronNet observed a large campaign in mid-2022 using **SMS and email** lures to steal **Citibank** financial information and **Microsoft** account credentials, and assessed that activity tied to the service had already enabled criminals to access more than **$500,000**. The kits include a customer dashboard, customizable phishing templates, anti-bot protections such as **reCAPTCHA** and user-agent filtering, and centralized API-based collection of stolen data, with exfiltrated information also shareable through **Telegram**. The reporting warned that Robin Banks could also support **corporate initial access** because it harvests **Google** and **Microsoft** credentials in addition to banking data. Defensive guidance aligned with **MITRE ATT&CK `M1017`** highlights user training and policy enforcement as key mitigations against phishing-driven credential theft, including verifying requests through independent channels, avoiding unknown links and attachments, distrusting certificate warnings, limiting risky browser extensions, and approving only legitimate MFA prompts.
Aug 14, 2026
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026
Threat actors are abusing legitimate email and collaboration workflows to make social-engineering lures appear trustworthy. A reported campaign weaponizes **OpenAI’s “invite your team”** feature by placing malicious URLs or scam phone numbers in the organization name field, causing invitations to be sent from legitimate OpenAI email infrastructure and increasing the likelihood recipients will click links or call attacker-controlled numbers; the approach is particularly effective against businesses because a single invite workflow can target multiple employees. Separately, consumers are being targeted by a seasonal surge of **tax-refund/back-tax impersonation scams** delivered via SMS and email that direct victims to malicious links or fraudulent call centers to “verify” identity—harvesting SSNs and banking details for identity theft and refund fraud. Compounding the broader email-risk environment, **Gmail’s spam filtering and tab categorization reportedly malfunctioned** at large scale, pushing promotional mail into Primary inboxes and flagging legitimate senders with warnings; such misclassification can increase exposure to phishing by reducing the effectiveness of inbox triage and user trust signals during active scam waves.
Jun 29, 2026