Threat actors have identified a flaw in Robinhood's account creation process that allows them to inject custom phishing messages into legitimate system-generated emails. By manipulating the 'Name' field during sign-up, attackers can send 'Official' notifications that trick users into clicking malicious links. This 'Workflow Subversion' is a rising trend where legitimate SaaS communications are weaponized.