n8n Webhooks Deliver Malware in Phishing Campaigns
Security researchers at Cisco Talos have identified sustained abuse of the n8n AI workflow automation platform, with threat actors using tti.app.n8n.cloud subdomains to send automated phishing emails and deliver malicious payloads. The activity spans October 2025 through March 2026 and includes campaigns that both distribute malware and fingerprint targeted devices. Attackers exploit the legitimate platform to bypass email filters and reputation-based defenses by routing delivery through trusted infrastructure. Organizations should treat third-party workflow automation endpoints as risky, review allowlists, tighten account registration controls, and add webhook monitoring to email security and threat-hunting processes.
What happened
Cisco Talos uncovered sustained misuse of the n8n workflow automation platform, showing threat actors creating developer-hosted endpoints on tti.app.n8n.cloud and using those endpoints to send automated phishing emails that deliver malicious payloads or fingerprint devices. The timeline runs from October 2025 through March 2026, and researchers observed the abuse emerging in multiple campaigns that leverage n8n's legitimate automation features to evade conventional detection. "By leveraging trusted infrastructure, these attackers bypass traditional security filters, turning productivity tools into delivery vehicles for persistent remote access," Cisco Talos wrote.
Technical details
The abuse relies on n8n's normal feature set: account creation yields a subdomain, workflows can call webhooks and integrate with external APIs, and hosted services allow unauthenticated or poorly monitored endpoints. Key mechanics observed include:
- •Creating free developer or trial accounts that provision subdomains under tti.app.n8n.cloud
- •Configuring workflows to send bulk or targeted emails using the platform's email or webhook capabilities
- •Hosting payloads or redirectors on the provisioned subdomain to avoid reputation-based blocking
- •Using automation to fingerprint victim environments before delivering a final payload
These behaviors give attackers the operational benefit of trusted TLS certificates and good domain reputation, which reduces the chance that email gateways or URL scanners will flag the messages. Cisco Talos documented specific examples and behavioral indicators that defenders can monitor in network and email telemetry.
Context and significance
This is the latest example in a broader trend where legitimate productivity and low-code platforms such as Zapier and Softr.io are weaponized for phishing and malware delivery. Security teams increasingly face adversaries who abuse third-party SaaS infra to blend malicious activity with benign traffic. For defenders this changes assumptions: allowlisting vendor domains or IP ranges is no longer a full defense because abused accounts create low-friction, high-reputation delivery channels. The move also underscores how agentic AI features in modern automation platforms expand attacker capability to orchestrate personalized, automated campaigns at scale.
What to watch
Monitor for unusual account provisioning, spikes in outbound email activity originating from workflow subdomains, and any redirects hosted on tti.app.n8n.cloud. Vendors and enterprises should expect additional disclosures and possibly mitigations from n8n, and defenders should update detection rules and threat hunting playbooks to include workflow automation telemetry. Practical mitigations include tightening registration controls, enforcing multi-factor authentication and billing validation, blocking or scrutinizing third-party subdomains in high-risk contexts, and integrating webhook behavior into DLP and email-gateway policies.
Scoring Rationale
This is a notable operational shift: abuse of workflow automation platforms materially raises phishing and malware delivery risk for enterprises. The finding is actionable for defenders and likely to prompt vendor and security-control changes, but it is not a new foundational discovery.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problemsStep-by-step roadmaps from zero to job-ready — curated courses, salary data, and the exact learning order that gets you hired.
