n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

2026-04-16

Attackers register free n8n cloud accounts, create webhook URLs on *.app.n8n.cloud, and embed those links in phishing emails that pose as shared documents. When victims click, JavaScript-driven workflows serve CAPTCHAs, drop malware installers, and deploy modified RMM tools like Datto or ITarian for persistence and C2 access.