Loading story…
Cisco Talos reported that threat actors are abusing the workflow automation platform n8n to run phishing campaigns, deliver malware, and fingerprint targets through trusted *.app.n8n.cloud webhook infrastructure. The activity has been observed since at least October 2025, and Talos said email volume containing these links in March 2026 was about 686% higher than in January 2025. In observed campaigns, emails posing as shared documents or Microsoft OneDrive messages directed recipients to n8n-hosted pages that used CAPTCHA prompts to make the activity appear legitimate before redirecting victims to external malware downloads.
The downloaded payloads included executables and MSI installers that deployed modified legitimate remote monitoring and management tools, including Datto RMM and ITarian Endpoint Management, to establish persistence, enable command execution, and support data exfiltration. Talos also found n8n webhook URLs embedded as invisible tracking pixels in emails, allowing attackers to confirm message opens and collect device information for victim profiling. The findings show how legitimate low-code and AI automation services can be repurposed as stealthy attack infrastructure that helps bypass conventional email and web filtering defenses.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A Gurucul threat research notice detailed ongoing abuse of n8n and similar AI workflow automation platforms in phishing and malware campaigns, and released multiple malicious URLs, two SHA-256 hashes, and example detection queries. The publication gave defenders concrete indicators and hunting guidance tied to the activity.
Talos also observed n8n webhook URLs embedded as invisible tracking images in emails to confirm when messages were opened and collect recipient device information for fingerprinting.
In one observed campaign, phishing emails posing as shared documents or Microsoft OneDrive content led victims to an n8n-hosted CAPTCHA page that triggered downloads of malicious executables or MSI installers from an external host. The payloads deployed modified legitimate remote management tools including Datto RMM and ITarian Endpoint Management for persistence, command execution, and data exfiltration.
Cisco Talos reported that email volume containing n8n webhook URLs in March 2026 was about 686% higher than in January 2025, indicating a significant escalation in abuse of the platform's trusted infrastructure.
Cisco Talos said attackers have been abusing n8n-hosted webhook URLs on trusted *.app.n8n.cloud subdomains since at least October 2025 to support phishing, malware delivery, and device fingerprinting while blending into legitimate infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcetechrepublic.com
Open sourcesecurityaffairs.com
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A maximum-severity vulnerability, tracked as CVE-2026-21858 and dubbed 'Ni8mare,' was disclosed in the n8n workflow automation platform, allowing unauthenticated remote code execution and potential full system compromise on locally deployed instances running versions prior to 1.121.0. The flaw arises from improper validation of incoming data in form-based workflows, enabling attackers to craft requests that bypass expected content-type checks and execute arbitrary code. This vulnerability has drawn significant attention in the security community, with reports highlighting the risk of full environment compromise and the rapid exploitation potential due to n8n's widespread use in automation and integration workflows. Concurrently, underground forums have surfaced with alleged exploit sales targeting n8n, further amplifying the threat landscape for organizations relying on this platform. In addition to the core vulnerability, researchers identified a supply chain attack involving malicious npm packages masquerading as legitimate n8n integrations. These packages, once installed, exfiltrate OAuth tokens and API keys from enterprise workflows, representing a new escalation in supply chain threats targeting automation platforms. While there is no confirmed link between the npm supply chain attack and the CVE-2026-21858 vulnerability, both incidents underscore the growing focus of threat actors on the n8n ecosystem. Security experts warn that organizations may overlook these risks, as automation platforms often operate deep within business processes and may not be subject to the same scrutiny as traditional build systems. The convergence of a critical RCE flaw and active supply chain threats highlights the urgent need for patching, vigilant monitoring of third-party integrations, and enhanced supply chain security practices for n8n deployments.
Jun 29, 2026
Security researchers reported that cybercriminals are increasingly abusing cloud tunneling services—especially **ngrok**—to expose internal systems and hide malicious infrastructure behind temporary internet-facing tunnels. Trend Micro said ngrok accounted for about **99%** of the tunneling HTTP traffic it observed in 2021, and nearly **16,000** unique malware samples used ngrok to route command-and-control traffic. The activity spans phishing pages impersonating brands including Instagram, Facebook, Bank of America, Gmail, PayPal, Netflix, and Dropbox, as well as malware families such as **njRAT**, **DarkComet**, **AsyncRAT**, and **NanoCore**. Researchers also described internal abuse cases in which attackers exposed services like **SMB** and **HTTP** from compromised or corporate systems, including one incident where an exposed SMB service was used with **SmbExec** to gain a Windows shell and deploy a keylogger. Separate reporting tied ngrok infrastructure to the revived **rinfo** botnet, a bash-based scanning and cryptomining operation that used temporary `ngrok.io` domains for payload delivery and reporting. Netlab 360 said the campaign had logged **11,864** scanner samples, **1,754** miner samples, and **3,232** ngrok-based C2 domains by early 2021. The updated botnet dropped some older targets and added **Mongo**, **Confluence**, and **vBulletin**, while continuing to use internet scanning tools to find exposed services and deploying miners after compromise. The miner component also stole files named `credentials` and `.npmrc` from `/home` directories and modified firewall rules with `iptables`, underscoring how tunneling services are being folded into broader intrusion, persistence, and monetization workflows.
Aug 15, 2026
Threat actors published **malicious npm packages** masquerading as legitimate *n8n* community nodes, abusing n8n’s extensibility to **steal OAuth tokens and other sensitive credentials** from environments that installed the rogue integrations. Reporting identified at least **eight** fake nodes impersonating popular services (e.g., Google Ads, Stripe, Salesforce), including `n8n-nodes-hfgjf-irtuinvcm-lasdqewriit` and `n8n-nodes-gasdhgfuy-rejerw-ytjsadx`, with authors using pseudonymous handles such as **kakashi-hatake**, **zabuza-momochi**, **dan_even_segler**, **hezi109**, **haggags**, **vietts_code**, and **diendh**. The packages prompted users to authenticate in seemingly legitimate flows and then exfiltrated credentials to attacker-controlled infrastructure; several packages were removed after discovery, while additional related packages from some of the same accounts were still being tracked for potentially similar behavior. Separately, a government advisory warned of **multiple high-severity vulnerabilities in n8n**—including `CVE-2026-21858` (improper input validation that may enable **unauthenticated remote code execution** via webhook request parsing and file handling), alongside `CVE-2026-21877` and `CVE-2025-68613`—and provided mitigation and detection guidance for defenders. This vulnerability advisory is distinct from the npm supply-chain campaign (malicious third-party nodes vs. core product flaws), but both issues increase risk for organizations running n8n, particularly **self-hosted deployments** that may function as centralized stores for OAuth tokens, API keys, and other integration secrets.
Jun 29, 2026