Threats Tagged 'webhook abuse'

Between late September 2025 and early April 2026, the threat group BlueDelta conducted espionage campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye. They deployed HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic-themed lures. HOOKEDGE shares code and tradecraft overlap with the HEADLACE backdoor and abuses legitimate webhook services for command-and-control, payload staging, and data exfiltration. The implant was continuously refined to evade sandbox detection and adapt to webhook service constraints. BlueDelta used a tiered operational model, deploying second-stage payloads with shorter beaconing intervals for high-value targets while preserving initial access infrastructure.

MediumMalwareRomaniaSpainTurkey#apt28#headlace#diplomatic targeting

Investigation reveals widespread abuse of n8n, an AI workflow automation platform, in sophisticated phishing campaigns from October 2025 through March 2026. Attackers exploit the platform's webhook functionality to deliver malware and fingerprint devices while bypassing security filters through trusted infrastructure. Email volume containing n8n webhook URLs increased by 686% between January 2025 and March 2026. Observed campaigns utilize CAPTCHA-protected pages to deliver remote access tools including modified Datto RMM and ITarian Endpoint Management software. The webhooks mask malicious payload sources behind legitimate n8n domains. Additional abuse cases involve tracking pixels embedded in emails for device fingerprinting. These attacks demonstrate how legitimate productivity and automation platforms can be weaponized, requiring behavioral detection approaches rather than simple domain blocking to protect organizational workflows.