AI workflow automation platforms are rapidly becoming essential tools for modern businesses, seamlessly connecting applications like Slack and Google Sheets with advanced language models.
However, threat actors are increasingly weaponizing these trusted environments. According to recent intelligence from Cisco Talos, attackers are actively abusing n8n a popular workflow automation platform to deliver malware and fingerprint target devices.
The n8n platform allows users to build automated workflows and offers community-licensed, self-hosted versions alongside commercial cloud services.
When developers register for a free account, they receive a unique subdomain on the n8n cloud network.
Talos researchers have observed cybercriminals exploiting this architecture, resulting in a staggering 686% increase in malicious emails containing n8n webhook URLs between January 2025 and March 2026.
Weaponizing Trusted Webhooks
The primary vector for this abuse relies on URL-exposed webhooks. Acting as “reverse APIs,” these webhooks allow applications to receive real-time data streams.
Attackers embed n8n webhook URLs in phishing emails, effectively leveraging the platform’s trusted domain to mask the true source of malicious payloads.
In one prominent campaign analyzed by Talos, threat actors disguised n8n webhook links as shared Microsoft OneDrive folders.
When a victim clicked the link, their browser loaded a webpage presenting a CAPTCHA challenge. Solving the CAPTCHA triggered a JavaScript-driven download of an executable file that appeared to originate from the trusted n8n domain.
This specific payload masqueraded as a self-extracting archive that secretly installed a modified Datto Remote Monitoring and Management (RMM) tool, establishing a persistent connection to attacker-controlled relays.
A secondary campaign utilized a similar CAPTCHA-protected webhook but delivered a maliciously modified Microsoft Windows Installer file.
Packed with Armadillo anti-analysis protections, this payload deployed a backdoored version of the ITarian Endpoint Management RMM. The malware executed Python modules to exfiltrate system data while displaying a fake installation progress bar to deceive the user.
Beyond payload delivery, threat actors are leveraging n8n webhooks for stealthy device fingerprinting.
By embedding invisible tracking pixels in HTML emails, attackers force the victim’s email client to send an HTTP GET request to the webhook URL when the message is opened.
This automatically captures the victim’s IP address, verifies the email account’s activity, and gathers target telemetry without requiring any direct interaction.
Securing Automated Workflows
Because workflow automation platforms are inherently flexible and highly interconnected, defending against this abuse requires more than simple static analysis.
Security teams cannot rely on blanket domain blocking, as blocklisting domains like n8n’s cloud infrastructure would severely disrupt legitimate business operations.
Talos recommends that organizations adopt behavior-based detection methodologies and implement the following defensive strategies:
- Monitor network traffic for high volumes directed toward automation platforms from unexpected or unauthorized internal sources.
- Configure immediate alerts for endpoint communications with automation domains that fall outside the organization’s intentionally designed workflows.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
