News

Cybercriminals have been abusing n8n, a widely used AI-enabled workflow automation service, to power advanced phishing operations that deliver malicious software and collect device or recipient fingerprints through automated email messages.

In a report released by Cisco Talos, researchers Sean Gallagher and Omid Mirzaei explain that attackers are taking advantage of the platform’s legitimate infrastructure to evade conventional security checks, effectively turning productivity tooling into a conduit for long-running remote access and malware distribution.

n8n lets users link web apps, APIs and AI model services to synchronize information, build agent-style automation and execute repetitive rule-driven tasks. Developers can sign up for a free account to use a hosted, managed cloud offering so they don’t need to run their own servers. That hosted service assigns each account a custom domain in the format <account name>.app.n8n.cloud from which users access their workflows and integrations.

The platform also supports webhooks: per-instance URLs that can accept event-driven data from other applications and services and then trigger workflows. Each webhook is represented by a distinct URL, and those URLs are capable of returning programmatically generated HTML or other content to the requester.

Cisco Talos says that it is precisely these publicly accessible webhook URLs, all hosted under the same *.app.n8n[.]cloud namespace, that have been leveraged in phishing campaigns dating back to October 2025. Talos describes a webhook as a “reverse API” that registers an application as a listener to receive real-time data; when the webhook URL is called, the configured workflow runs and can stream back HTTP content to the calling application.

When a webhook URL is embedded in an email and the recipient’s browser loads it, the browser effectively becomes the requesting application and renders the returned output as a web page. That behavior gives attackers a way to make malicious content appear to come from a legitimate n8n domain, increasing the chances that security filters and end users will treat it as safe.

Talos observed that abuse of these n8n webhook URLs surged, noting that the number of emails containing such links in March 2026 was roughly 686% higher than the count in January 2025.

One campaign documented by Talos involved messages purporting to share a document. The email contained an n8n-hosted webhook link that, when followed, presented the victim with a CAPTCHA. Completing the CAPTCHA triggered JavaScript embedded in the returned HTML to fetch and initiate a download of a malicious payload hosted on an external server. Because the JavaScript initiates the transfer from within the HTML, the browser attributes the download to the n8n-hosted page.

The intended payloads in these attacks are Windows executables or MSI installers that drop tweaked versions of legitimate Remote Monitoring and Management (RMM) tools - examples include modified installers for products such as Datto and ITarian Endpoint Management. Those tools are then abused to create persistence and to reach back to a command-and-control (C2) infrastructure.

Another frequently observed tactic uses n8n webhook-hosted tracking elements. In these cases the attackers place an invisible image or tracking pixel on an n8n webhook URL inside an email. When the message is opened, the mail client performs an HTTP GET to the webhook URL and passes tracking parameters (often including the recipient’s email address), allowing the attackers to confirm opens and identify targets.

“Workflows that save developers hours of manual work are being repurposed to automate malware distribution and device fingerprinting because they are flexible, easy to integrate, and automatic,” Talos concluded. As low-code and no-code automation grows more prevalent, the researchers urge security teams to treat these platforms as potential attack surfaces and to take steps to ensure they remain business enablers rather than liabilities.