Back Securityaffairs.Co

AI platform n8n abused for stealthy phishing and malware delivery

Securityaffairs.Co •Pierluigi Paganini • April 16, 2026

Attackers abuse AI automation platform n8n to run phishing campaigns, deliver malware, and evade security by using trusted infrastructure. Threat actors are exploiting the popular AI workflow automation platform n8n to launch advanced phishing campaigns, deliver malware, and collect device data through automated emails. By using trusted infrastructure, they can bypass traditional security controls and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit n8n Webhooks for Malware Delivery and Phishing Cybercriminals are exploiting the n8n AI workflow automation platform to conduct phishing campaigns and deliver malware. Between October 2025 and March 2026, there was a 686% increase in phishing emails utilizing n8n-generated webhooks to deliver malicious payloads and collect device fingerprints. Attackers leverage n8n's webhook functionality, which allows them to send automated emails that appear to originate from trusted domains. These emails often contain links disguised as shared documents, leading users to download malware after completing a CAPTCHA. The malware includes modified versions of remote monitoring and management tools like Datto and ITarian. This trend highlights the growing misuse of legitimate automation tools for malicious purposes, posing a significant risk to organizations relying on such platforms. The current status indicates ongoing campaigns exploiting this vulnerability. 9 sources 65

Extracted Entities

AI platform n8n abused for stealthy phishing and malware delivery

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)