Hackers Abuse n8n AI Workflow Automation to Deliver Malware Through Trusted Webhooks

Cybersecuritynews •Tushar Subhra Dutta • April 16, 2026

Cybercriminals have found a new way to sneak malware past traditional security filters by hijacking a legitimate AI workflow automation tool called n8n. Rather than building their own infrastructure from scratch, these threat actors are turning a productivity platform into a weapon, using it to send phishing emails and deliver dangerous payloads directly to victims’ […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit n8n Webhooks for Malware Delivery and Phishing Cybercriminals are exploiting the n8n AI workflow automation platform to conduct phishing campaigns and deliver malware. Between October 2025 and March 2026, there was a 686% increase in phishing emails utilizing n8n-generated webhooks to deliver malicious payloads and collect device fingerprints. Attackers leverage n8n's webhook functionality, which allows them to send automated emails that appear to originate from trusted domains. These emails often contain links disguised as shared documents, leading users to download malware after completing a CAPTCHA. The malware includes modified versions of remote monitoring and management tools like Datto and ITarian. This trend highlights the growing misuse of legitimate automation tools for malicious purposes, posing a significant risk to organizations relying on such platforms. The current status indicates ongoing campaigns exploiting this vulnerability. 9 sources 65

Extracted Entities

Hackers Abuse n8n AI Workflow Automation to Deliver Malware Through Trusted Webhooks

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)