# Callback Phishing Campaign Impersonates Robinhood With Fake Sign-In Alerts (LevelBlue SpiderLabs)

> LevelBlue SpiderLabs identified an active callback-phishing (TOAD) campaign impersonating Robinhood security sign-in alerts, pressuring recipients to call one of 14 attacker-controlled toll-free numbers where operators pose as Robinhood support to harvest credentials and one-time codes, request remote-access software installation, or push through unauthorized transactions.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1171
- **ID:** TL-2026-1171
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This campaign follows the Telephone-Oriented Attack Delivery (TOAD) / callback-phishing pattern first popularized by BazarCall in 2020 and since adopted by groups including Silent Ransom Group (Luna Moth) and 3AM ransomware operators. Victims receive a message spoofing a Robinhood security notification claiming an unrecognized sign-in, but instead of a malicious link or attachment, the message directs the recipient to call one of 14 toll-free (877/888) numbers. This design deliberately evades automated email defenses: URL scanners have nothing to scan and sandboxes have no attachment to detonate, shifting the entire attack into a voice channel with far less security visibility. Once the victim calls, an attacker-controlled operator impersonates Robinhood support/security staff and applies urgency and authority pressure ("protecting your account") to extract login credentials, harvest one-time passcodes/MFA approvals, socially engineer the victim into installing remote-access software, or talk the victim through approving fraudulent transactions or withdrawals in real time. LevelBlue SpiderLabs, the same research team that has separately tracked a related callback-phishing campaign abusing Microsoft Azure Monitor alert notifications with fake invoice/unauthorized-payment lures, surfaced this Robinhood-themed wave in early July 2026. The campaign lands amid a broader wave of Robinhood-brand phishing activity in 2026, including an unrelated April 2026 incident in which a Robinhood account-creation flaw was abused to send phishing emails from noreply@robinhood.com (patched April 28, 2026) and ongoing 'fake security alert' scam reports tracked by Malwarebytes throughout 2025-2026 — underscoring Robinhood as a persistently attractive impersonation target for financially motivated social engineers because its users hold liquid, transferable brokerage and crypto assets.

## MITRE ATT&CK

- T1598.004 Spearphishing Voice
- T1583 Acquire Infrastructure
- T1585.002 Email Accounts
- T1566.004 Spearphishing Voice
- T1204 User Execution
- T1204.002 Malicious File
- T1684.001 Impersonation
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1219 Remote Access Tools
- T1056.002 GUI Input Capture
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Sources

- [Hackers Impersonate Robinhood With Fake Sign-in Alerts](https://cybersecuritynews.com/hackers-impersonate-robinhood-with-fake-sign-in-alerts/)
- [Robinhood scam text warning: fake security alert targets users nationwide](https://www.foxnews.com/tech/robinhood-text-scam-warning-do-not-call-number)
- [The Robinhood impersonation scam that we should all pay attention to](https://news.trendmicro.com/2026/05/13/robinhood-impersonation-scam/)
- [Scammers are still sending us their fake Robinhood security alerts](https://www.malwarebytes.com/blog/news/2025/10/scammers-are-still-sending-us-their-fake-robinhood-security-alerts)
- [Robinhood Vulnerability Exploited for Phishing Attacks](https://www.securityweek.com/robinhood-vulnerability-exploited-for-phishing-attacks/)
- [Callback Phishing Via Microsoft Azure Monitor Alert Notifications](https://x.com/SpiderLabs/status/2032446349094818119)
- [What Is Callback Phishing and How Does It Work?](https://abnormal.ai/learning/callback-phishing)
- [What is Callback Phishing (TOAD)?](https://ironscales.com/glossary/callback-phishing)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1171