The Automation Tool That Became a Weapon

When “Trusted” Domains Deliver the Payload

Here’s the core problem: email security is built on reputation. If a domain belongs to a known, legitimate service, filters give it a pass. That’s exactly what made this campaign work.

The attackers signed up for free developer accounts on n8n’s cloud platform. Each account automatically got a subdomain under the *.app.n8n.cloud namespace [1]. These subdomains are hosted on n8n’s infrastructure, which has high domain reputation scores. When phishing emails containing links to these subdomains hit corporate inboxes, the security gateways saw a trusted automation platform, not a threat.

Cisco Talos researchers Sean Gallagher and Omid Mirzaei documented the campaign in an April 16 report titled “The n8n n8mare” [1]. They found attackers running two distinct operations through the same trusted infrastructure.

Operation One: Fake OneDrive Documents That Install Remote Access Tools

The first operation was straightforward malware delivery. Victims received emails impersonating Microsoft OneDrive shared folder notifications. Click the link, and you land on what looks like a document download page, hosted on an n8n webhook URL.

But first, a CAPTCHA verification page. This isn’t just social engineering to make the page look legitimate. CAPTCHAs also block automated security scanners from analyzing the payload, buying the attackers time before the link gets flagged [1].

Pass the CAPTCHA, and the n8n webhook triggers a download. The payloads Talos identified included:

• A modified version of Datto RMM: a legitimate remote monitoring tool repurposed to give attackers persistent access to compromised machines. The executable was named “DownloadedOneDriveDocument.exe”, not exactly subtle, but effective against people expecting a document download
• ITarian Endpoint Management: another legitimate remote management tool, this one packed with Armadillo anti-analysis protection to make it harder for security researchers to reverse-engineer

Both are real, commercially available tools. That’s the second layer of trust exploitation: even if a victim’s antivirus flags the download, it’s flagging what appears to be a legitimate IT management application. The attackers aren’t writing custom malware. They’re abusing tools that thousands of IT departments already use.

Operation Two: The Invisible Tracking Pixel That Knows You Opened the Email

The second operation is quieter, and arguably creepier. No malware. No downloads. Just a 1x1 invisible image embedded in the email body, hosted on an n8n webhook URL [1].

When you open the email (even if you never click a link) your email client automatically loads that image. That single HTTP GET request sends the following back to the attackers:

• Your email address (encoded in the URL parameters)
• Your IP address
• Your email client and version (via the User-Agent header)
• Your operating system
• The time you opened the email

This is device fingerprinting. The attackers don’t need you to click anything. Opening the email is enough.

This technique isn’t new. Marketing companies have used tracking pixels for years. But when threat actors do it, the purpose changes. That fingerprint data tells them which targets use outdated email clients with known vulnerabilities. Which ones are on corporate networks versus personal devices. Which ones opened the email immediately (impulsive, likely to click) versus days later (cautious, needs a different approach).

It’s reconnaissance. The malware comes later, tailored to what they learned.

686% More Phishing Emails in 14 Months

Talos tracked the campaign from October 2025 through March 2026. The volume of malicious emails abusing n8n webhooks in March 2026 was approximately 686% higher than in January 2025 [1] [2]. That’s not gradual growth. That’s an operation that found a vector that works and scaled it fast.

The researchers note that the n8n platform’s webhook functionality is “dynamically serving content based on request headers” [1]. Translation: the same webhook URL can deliver different content depending on who’s visiting. Security scanners might see a benign page. Actual victims see the payload. That makes the campaign harder to detect and block at the network level.

Why This Is a Surveillance Story, Not Just a Cybersecurity Story

Tracking pixels that fingerprint devices without user interaction are the same technique used by commercial surveillance vendors, data brokers, and intelligence agencies. The difference is scale and intent, not technology.

NSO Group’s Pegasus infection chain has used zero-click techniques to profile targets before deploying the full spyware payload. Data brokers like LiveRamp and Oracle embed tracking pixels across millions of marketing emails to build device graphs linking email addresses to browser fingerprints, IP addresses, and physical locations. Now the same technique is available to any phishing operator with a free n8n account.

The n8n campaign demonstrates something the privacy community has warned about for years: infrastructure built for “legitimate” purposes (automation, analytics, marketing) creates surveillance capabilities that anyone can repurpose. You don’t need Pegasus-grade tools to track people. You need a webhook and a tracking pixel.

What n8n Has Done About It

n8n is an open-source project with both a self-hosted version and a cloud-hosted service. The abuse targets the cloud service, which provides the trusted *.app.n8n.cloud domains that make the campaign work.

The platform has implemented abuse detection on its cloud service, but the Talos report suggests these measures haven’t kept pace with the attackers. New free accounts can still create webhook URLs almost immediately. And because n8n is also available self-hosted, attackers who lose cloud access can spin up their own instances, though they’d lose the trusted domain reputation that makes the campaign effective [1].

This is a familiar tension in open-source tooling: the same flexibility that makes n8n useful for legitimate automation makes it useful for attackers. Locking down the platform restricts legitimate users. Leaving it open invites abuse.

How to Protect Yourself

• Disable automatic image loading in your email client. This is the single most effective defense against tracking pixels. In Gmail: Settings → General → Images → “Ask before displaying external images.” In Outlook: File → Options → Trust Center → “Don’t download pictures automatically.” In Apple Mail: Settings → Privacy → enable “Protect Mail Activity”
• Don’t trust a link just because the domain looks legitimate. n8n.cloud is real. So are the phishing pages hosted on it. Same goes for Google Docs, Notion, and any other platform that lets users create public-facing content
• Check for “DownloadedOneDriveDocument.exe” on your systems. If anyone in your organization downloaded this file, assume compromise. Isolate the machine, check for Datto RMM or ITarian installations you didn’t authorize, and reset credentials
• Block or monitor *.app.n8n.cloud at the network level if your organization doesn’t use n8n. This is a blunt instrument, but if nobody in your company needs n8n webhooks, there’s no reason to allow traffic to those domains
• Use an email client that strips tracking pixels. Proton Mail blocks remote content by default. Thunderbird can be configured to block remote images. Tuta strips tracking by default

The Bigger Problem: Every SaaS Platform Is a Potential Phishing Vector

n8n isn’t the first legitimate platform weaponized for phishing. Google Forms, Microsoft Teams, Notion, Slack, Trello: they’ve all been abused because they share the same vulnerability: high domain reputation and the ability for anyone to create public-facing content.

The security industry calls this “living off trusted services” (LOTS). It’s the cloud-era equivalent of living off the land: instead of using built-in operating system tools to avoid detection, attackers use built-in cloud services to bypass email filters.

Talos recommends organizations implement “behavioral detection monitoring unexpected internal traffic toward automation platforms” and “AI-driven email security with natural language processing capabilities” [1]. That’s good advice for enterprises. For individuals, the advice is simpler: don’t let your email client load images automatically, and don’t trust a link just because the domain is familiar.

References

1. Cisco Talos: “The n8n n8mare: How threat actors are misusing AI workflow automation” (April 16, 2026)
2. The Hacker News: “n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails” (April 16, 2026)
3. Cybersecurity News: “Hackers Abuse n8n AI Workflow Automation to Deliver Malware Through Trusted Webhooks” (April 16, 2026)
4. TechRepublic: “New Phishing Attack Turns n8n Into On-Demand Malware Machine” (April 2026)
5. GBHackers: “Hackers Exploit n8n Webhooks to Spread Malware” (April 2026)

Related Coverage

• ShinyHunters Hit 100+ Companies Through Okta SSO – Another trusted-platform supply chain attack
• Google’s Fourth Chrome Zero-Day This Year – Browser vulnerabilities used for surveillance payload delivery
• Vercel Breach via Context AI Supply Chain – The growing pattern of trusted-service compromise
• Supply Chain Attacks 2026: Your Vendors Are the Weak Link – How trusted third parties become the attack surface