Threat actors are exploiting the n8n low-code automation platform to distribute malicious payloads and profile email recipients. By embedding harmful webhook URLs in phishing messages, they can deliver executable files or MSI installers that deploy remote access tools on victim systems. The activity also includes the use of invisible tracking pixels that gather victim information as soon as the email is opened. This campaign highlights how a legitimate workflow automation service can be repurposed for malware delivery without requiring stolen credentials.
Cisco Talos analyzed a series of phishing campaigns observed between October 2025 and March 2026 that relied on n8n webhook URLs embedded in email messages. The lures used fake OneDrive links that first displayed a CAPTCHA prompt before serving either a malicious .exe or MSI file. Once executed, the payloads installed modified versions of Datto or ITarian RMM tools and created scheduled tasks to maintain persistence. Talos also found fingerprinting activity through image tags that called n8n webhook URLs containing victim-specific identifiers.
Organizations should monitor for unusual outbound traffic to n8n-related domains from systems that would not normally use automation services and inspect for suspicious webhook URL patterns. URLs resolving to unknown subdomains of n8n.cloud should be blocked or detonated in a sandbox before user access is allowed. Email security controls should also be tuned to detect malicious HTML content, fake CAPTCHA flows, and hidden tracking pixels. Relevant IOCs, including webhook URLs and malicious file hashes, should be shared with threat intelligence platforms and internal defenders.
Security teams should alert on the presence of n8n webhook URLs in email content or network telemetry and isolate any impacted hosts as soon as suspicious activity is confirmed. Any installed RMM tools and related scheduled tasks should be removed, followed by forensic analysis to uncover additional persistence or follow-on payloads. Firewall and proxy policies should be updated to restrict access to unauthorized n8n endpoints. Organizations should also complete a full IOC-sharing process across internal teams and trusted external partners.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
An attacker purchases a short‑lived domain that points to n8n.cloud/webhook . They create a malicious n8n workflow that, once triggered, serves a ransomware payload. The phishing email contains a link to a landing page with a CAPTCHA challenge. The victim solves the CAPTCHA, which the attacker’s JavaScript forwards as the value CAPTCHA=solved123 in the HTTP body of a POST request to the webhook. The webhook responds with a PowerShell downloader that executes the payload. This flow generates an HTTP request whose URL contains n8n.cloud/webhook and whose body contains the string CAPTCHA , perfectly matching the Sigma rule.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
