The n8n n8mare: How threat actors are misusing AI workflow automation

Investigation reveals widespread abuse of n8n, an AI workflow automation platform, in sophisticated phishing campaigns from October 2025 through March 2026. Attackers exploit the platform's webhook functionality to deliver malware and fingerprint devices while bypassing security filters through trusted infrastructure. Email volume containing n8n webhook URLs increased by 686% between January 2025 and March 2026. Observed campaigns utilize CAPTCHA-protected pages to deliver remote access tools including modified Datto RMM and ITarian Endpoint Management software. The webhooks mask malicious payload sources behind legitimate n8n domains. Additional abuse cases involve tracking pixels embedded in emails for device fingerprinting. These attacks demonstrate how legitimate productivity and automation platforms can be weaponized, requiring behavioral detection approaches rather than simple domain blocking to protect organizational workflows.

• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Behind the Connect Button: The Fake AI Ads CampaignCampaign2026-10-07
• PureRAT and PureLogs Campaign Targeting Japanese OrganizationsCampaign2026-09-25