Hackers Exploit n8n Webhooks to Spread Malware

Gbhackers •Mayura Kathir • April 16, 2026

A new abuse campaign targeting AI-driven workflow automation platforms particularly n8n that turns legitimate automation tools into powerful malware delivery systems. Between October 2025 and March 2026, security analysts observed a sharp surge in phishing emails that weaponized n8n-generated webhooks to deliver malicious payloads and collect device fingerprints under the guise of trusted infrastructure. AI workflow platforms like n8n and Zapier are […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit n8n Webhooks for Malware Delivery and Phishing Cybercriminals are exploiting the n8n AI workflow automation platform to conduct phishing campaigns and deliver malware. Between October 2025 and March 2026, there was a 686% increase in phishing emails utilizing n8n-generated webhooks to deliver malicious payloads and collect device fingerprints. Attackers leverage n8n's webhook functionality, which allows them to send automated emails that appear to originate from trusted domains. These emails often contain links disguised as shared documents, leading users to download malware after completing a CAPTCHA. The malware includes modified versions of remote monitoring and management tools like Datto and ITarian. This trend highlights the growing misuse of legitimate automation tools for malicious purposes, posing a significant risk to organizations relying on such platforms. The current status indicates ongoing campaigns exploiting this vulnerability. 9 sources 65

Extracted Entities

Hackers Exploit n8n Webhooks to Spread Malware

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)