2026-04-15 · 2026-Q2
n8n Webhook Weaponization for Phishing Campaigns
Outside the model: Offensive useAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
n8n AI workflow automation platform (cloud-hosted webhooks)
Impact
Attackers embed n8n-hosted webhook URLs in phishing emails; clicking opens a JavaScript CAPTCHA page on the trusted n8n domain that then downloads modified RMM tools such as Datto and ITarian; March 2026 volume of emails carrying these URLs was 686% higher than January 2025
Root cause
Public webhook URLs on trusted n8n infrastructure let attackers bypass email security filters that would otherwise block attacker-controlled domains; abuse first observed October 2025 and escalated through April 2026
Sources
Catalog
Cite this: AgentProv incident record: n8n Webhook Weaponization for Phishing Campaigns (2026-04-15). https://agentprov.com/incidents/2026-04-15-n8n-webhook-weaponization-for-phishing-campaigns