phishing emails

The user discovered two fake phishing emails in their spam folder, one originating from an address in Egypt and using the name of the user's son. The second email used a misspelled first name associated with the user's sibling, despite the user not possessing that sibling's direct email address.

Robinhood's account creation process was exploited by threat actors to inject phishing messages into legitimate emails, deceiving users into believing their accounts had suspicious activity. This security flaw allowed attackers to impersonate the platform and trick users into engaging with malicious links.

Threat actors have been exploiting n8n, an AI workflow automation platform, since October 2025 to bypass security filters and deliver malware via phishing emails. These campaigns automate malicious email distribution, enabling device fingerprinting and payload delivery through trusted infrastructure.