Threat Actors Exploit n8n Webhooks for Malware Delivery and Phishing

• •n8n webhooks are being exploited for phishing and malware delivery.
• •Phishing emails embedding n8n links increased by 686% from January 2025 to March 2026.
• •Attackers use legitimate automation tools to bypass traditional security measures.

Cybercriminals are exploiting the n8n AI workflow automation platform to conduct phishing campaigns and deliver malware. Between October 2025 and March 2026, there was a 686% increase in phishing emails utilizing n8n-generated webhooks to deliver malicious payloads and collect device fingerprints. Attackers leverage n8n's webhook functionality, which allows them to send automated emails that appear to originate from trusted domains. These emails often contain links disguised as shared documents, leading users to download malware after completing a CAPTCHA. The malware includes modified versions of remote monitoring and management tools like Datto and ITarian. This trend highlights the growing misuse of legitimate automation tools for malicious purposes, posing a significant risk to organizations relying on such platforms. The current status indicates ongoing campaigns exploiting this vulnerability.