Threat actors have been seen using n8n, a well-known artificial intelligence (AI) workflow automation tool, as a weapon to enable complex phishing campaigns and send automated emails that transmit malware payloads or fingerprint devices.
According to an analysis released today by Cisco Talos researchers Sean Gallagher and Omid Mirzaei, these attackers circumvent conventional security filters by using trusted infrastructure, transforming productivity tools into delivery vehicles for permanent remote access.
N8n is a platform for workflow automation that enables users to connect different web apps, APIs, and AI model services in order to conduct recurring rule-based processes, create agentic systems, and sync data.
To use a managed cloud-hosted service and automate workflows without setting up their own infrastructure, users can sign up for a developer account at no additional cost read more about n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.