n8n Webhooks Exploited in Phishing Campaigns Since October 2025
In October 2025, threat actors began exploiting n8n, a widely-used AI workflow automation platform, to conduct sophisticated phishing campaigns. By creating malicious webhooks on n8n's trusted infrastructure, attackers were able to bypass traditional security filters and deliver malware or perform device fingerprinting through automated emails. This abuse allowed them to distribute malicious payloads and gather sensitive information from targeted devices. ([thehackernews.com](https://thehackernews.com/2026/04/n8n-webhooks-abused-since-october-2025.html?utm_source=openai)) The exploitation of legitimate automation platforms like n8n underscores a growing trend where attackers leverage trusted services to evade detection. This incident highlights the need for organizations to scrutinize third-party integrations and enhance monitoring of automated workflows to prevent similar abuses. ([blog.talosintelligence.com](https://blog.talosintelligence.com/the-n8n-n8mare/?utm_source=openai))
Kill Chain
