Since October 2025, cybercriminals have been actively exploiting the webhook functionality of the n8n workflow automation platform to deliver malware and conduct advanced phishing campaigns. By leveraging the trusted cloud infrastructure of n8n, attackers have been able to bypass traditional email security controls, automate malicious payload delivery, and perform device fingerprinting on victims. This abuse…
