n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails
Heads up if you use n8n (or any cloud automation tool, really). Cisco Talos just reported a phishing campaign abusing n8n Cloud webhooks that's up ~700% since January 2025. How it works: an attacker signs up for a free n8n Cloud account, creates a webhook, and gets a URL on the shared *.app.n8n.cloud domain. Email filters trust that parent domain, so the phishing link gets through. The victim clicks, sees a fake CAPTCHA hosted on what looks like a legit n8n URL, and downloads malware, except the browser thinks the file came from a trusted source. A second variant uses an invisible tracking pixel pointing at an n8n webhook, so just opening the email tells the attacker who you are. The attackers aren't hacking n8n. They're borrowing n8n Cloud's reputation by living under its domain. The takeaway: this attack falls apart if your automation runs on your own domain instead of a shared cloud subdomain. Self-hosted orchestrators sidestep the whole thing, there's no free signup for attackers to abuse, no big trusted brand to hide behind. Just your domain. Two quick things worth doing: - Make sure every webhook has authentication enabled (HMAC signature or header token, not "none") - Be skeptical of any email link pointing to *.app.n8n.cloud you weren't expecting, even from people you know Source: https://thehackernews.com/2026/04/n8n-webhooks-abused-since-october-2025.html Personal note: I never liked public wide-open webhooks that services like make.com, n8n and airtable use and this is why.