Attackers Weaponize n8n Webhooks to Automate Malware Distribution
Security researchers have identified a persistent campaign abusing the popular workflow automation tool n8n to deliver sophisticated malware via phishing emails, bypassing traditional gateway filters.
LONDON — Since October 2025, a sophisticated threat actor has been exploiting the webhook functionality of n8n, an open-source workflow automation platform, to facilitate a global phishing campaign. According to a joint report from Cisco Talos and other intelligence groups, the campaign — dubbed "n8mare" — leverages the platform's legitimate infrastructure to host and deliver malicious payloads, effectively "living off the reputation" of trusted cloud services.
By using n8n’s automated webhooks to process and redirect phishing traffic, attackers have successfully evaded common email security filters that often permit traffic from known automation and productivity tools.
The Anatomy of the Abuse
The campaign begins with a standard phishing email, often disguised as an invoice or a mandatory security update. However, rather than linking directly to a malicious domain, the email contains a link to an n8n-hosted webhook.
When a victim clicks the link, the n8n workflow triggers a series of automated steps:
- User Verification: The workflow checks the victim's IP and user-agent string to ensure it is a live target and not a security sandbox.
- Payload Delivery: If verified, the workflow automatically redirects the user to a cloud storage bucket containing malware, such as Lumma Stealer or Agent Tesla.
- Data Exfiltration: In some instances, the n8n instance is used as a temporary command-and-control (C2) server to receive exfiltrated data before forwarding it to the final attacker-controlled server.
Timeline of the Campaign
The "Trusted Service" Dilemma
This campaign highlights a growing trend in supply chain abuse where attackers do not compromise the software itself, but rather exploit its intended functionality. Because n8n is a legitimate tool used by thousands of enterprises for business process automation, IT departments often whitelist its domains and webhooks.
Security researchers emphasize that the fault does not lie with n8n’s security architecture, but with the inherent risk of allowing unauthenticated webhooks to perform external redirects.
The CyberSignal Analysis
Signal 01 — The Automation-to-Exploitation Pipeline
The "n8mare" campaign proves that automation is a double-edged sword. While tools like n8n and Zapier increase efficiency for businesses, they also provide attackers with a low-cost, highly scalable infrastructure for malware distribution. As we noted in our coverage of MFA Bypass tactics, attackers are moving away from building their own malicious infrastructure and are instead co-opting the tools your team already trusts.
Signal 02 — The Importance of "URL Rewriting" and Sandbox Inspections
Standard email gateways are increasingly failing to detect "automated" threats. For organizations using n8n, this incident is a call to implement stricter egress filtering. Webhooks should never be allowed to serve as an open proxy to the public internet. Modern security teams must move toward inspecting the destination of the automation, rather than just the source of the link.
