2026-04-15 · 2026-Q2
n8n Webhook Weaponization for Phishing Campaigns
Outside the model: Offensive use Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- No, architectural
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
n8n AI workflow automation platform (cloud-hosted webhooks)
Impact
Attackers embed n8n-hosted webhook URLs in phishing emails; clicking opens a JavaScript CAPTCHA page on the trusted n8n domain that then downloads modified RMM tools such as Datto and ITarian; March 2026 volume of emails carrying these URLs was 686% higher than January 2025
Root Cause
Public webhook URLs on trusted n8n infrastructure let attackers bypass email security filters that would otherwise block attacker-controlled domains; abuse first observed October 2025 and escalated through April 2026