Low-Code Webhooks Turn n8n Into a Malware Delivery Vector for Phishing
TL;DR
Threat actors are abusing exposed n8n webhooks to run phishing campaigns, delivering malware via CAPTCHA-triggered downloads and fingerprinting victims, enabling persistence through modified RMM tools and C2 communication.
- n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails The Hacker News
- The n8n n8mare: How threat actors are misusing AI workflow automation Cisco Talos Blog
- AI workflow platform n8n abused for phishing and device fingerprinting SC Media
- Malware Delivered Through Trusted Webhooks In New n8n Abuse Campaign cyberpress.org
- Hackers Abuse n8n AI Workflow Automation to Deliver Malware Through Trusted Webhooks CyberSecurityNews
Want the full story? Read the original reporting
Read on The Hacker News