Robinhood Users Targeted in Phishing Attack Exploiting Gmail Dot Alias Feature

Gate News message, April 28 — Robinhood users have recently fallen victim to a phishing attack that exploits Gmail's dot-ignoring feature and vulnerabilities in Robinhood's account creation process. Attackers registered accounts nearly identical to target email addresses, allowing them to trick Robinhood's mail servers into delivering fraudulent security alerts containing phishing links to victims' inboxes.

According to cybersecurity researcher Alex Eckelberry, the malicious emails pass SPF, DKIM, and DMARC verification checks, making them appear to originate from official Robinhood addresses. This authentication bypass significantly increases the attack's credibility.

Robinhood confirmed that no system breach or customer account compromise occurred, and user funds and personal information remain secure. The platform advised users to delete suspicious emails and avoid clicking on any questionable links.