Abuse of n8n automation platforms in large-scale phishing campaigns

Du'aine Davis

Observed in the wild

• Cisco Talos reported a sustained increase in phishing emails abusing n8n automation webhooks from October 2025 to March 2026, impacting enterprise email users. Campaigns impersonated trusted services to deliver malware or silently fingerprint recipients. Email volumes containing n8n webhook URLs rose sharply, indicating broad, opportunistic targeting rather than a single sector focus.
• Threat actors abused n8n URL-exposed webhooks to host phishing pages, CAPTCHA-gated malware delivery, and tracking pixels. Payloads included modified legitimate RMM tools via EXE or MSI files, followed by PowerShell execution and persistence via scheduled tasks. Webhooks masked malicious infrastructure by making traffic appear to originate from trusted n8n domains.
• Defenders are advised to monitor for unexpected endpoint or user interaction with n8n.cloud domains where n8n is not an approved business tool. In Microsoft Defender, prioritise alerts for suspicious PowerShell spawned by installers, anomalous RMM tool installation, and user-driven downloads following CAPTCHA pages. Email security should flag webhook-style URLs, fake OneDrive lures, and tracking-pixel behaviour in inbound emails.

The n8n n8mare: How threat actors are misusing AI workflow automation