The n8n n8mare: How threat actors are misusing AI workflow automation
Summary: Cisco Talos reports that threat actors are abusing n8n, an AI workflow automation platform, using its URL-exposed webhooks to deliver malware and fingerprint devices through automated emails. Emails containing n8n webhook URLs rose approximately 686% in March 2026 compared with January 2025, and Talos documented campaigns delivering a modified Datto RMM tool via a file named "DownloadedOneDriveDocument.exe" and a modified ITarian RMM backdoor via "OneDrive_Document_Reader_pHFNwtka_installer.msi".
Key Takeaway: Webhooks mask the source of the data they deliver, so payloads appear to come from a trusted domain, and because they can serve different content based on request headers, a phishing operator can tailor what each recipient receives. Talos observed abuse of more than 25 legitimate platforms over the past year, which means blocking entire domains would disrupt legitimate business workflows.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026