Hackers abused a Robinhood notification system and Gmail’s dot trick to send real-looking phishing emails from “[email protected].”