robinhooddesktopwallet[.]app

This domain, robinhooddesktopwallet.app, poses a high-risk brand impersonation threat targeting Robinhood users. The site mimics the official Robinhood Wallet desktop application, presenting itself as a legitimate download portal for Windows systems. Analysis indicates the domain is designed to deceive users into downloading malicious software, likely intended for credential theft or unauthorized access to cryptocurrency wallets. The fraudulent page title, 'Robinhood Wallet Desktop - Download for Windows | Official,' reinforces the illusion of legitimacy, increasing the likelihood of successful exploitation. Infrastructure analysis reveals the domain was registered on July 07, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 45.74.7.185 and is currently flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX and is classified as phishing by Google Safe Browsing. The combination of these indicators confirms the domain's malicious intent and active status. Users who visited robinhooddesktopwallet.app or downloaded files from it should immediately disconnect the affected system from the network. Scan the device using updated security tools to detect and remove any malicious payloads. Reset credentials for Robinhood and any associated financial accounts, enabling multi-factor authentication where possible. Monitor accounts for unauthorized transactions and report the incident to the appropriate security teams or financial institutions. Avoid interacting with the domain or any links associated with it.