# Automation Platforms Become Weaponized Infrastructure: N8N Exploited for Phishing and Malware Distribution


Threat actors have been systematically abusing n8n, a widely-deployed open-source workflow automation platform, to orchestrate large-scale phishing campaigns and deliver malware payloads since at least October 2025. By exploiting the platform's webhook functionality and leveraging its trusted reputation, attackers have circumvented traditional email security filters and used legitimate automation infrastructure as a launchpad for credential theft, device fingerprinting, and payload distribution.


## The Threat


Security researchers tracking this campaign have identified a sophisticated abuse pattern in which threat actors create workflow automation chains on compromised or openly-accessible n8n instances, then configure webhooks to dispatch phishing emails at scale. The approach is deceptively simple yet effective: attackers abuse n8n's email sending capabilities to route malicious messages through infrastructure that mail gateways and filters recognize as legitimate automation traffic.


Key characteristics of the observed attacks include:


  • Scale and frequency: Campaigns have targeted thousands of recipients across multiple verticals, with some attackers sending thousands of phishing messages daily
  • Payload variety: Delivered malware includes information stealers, backdoors, and credential-harvesting HTML attachments designed to mimic login portals
  • Device fingerprinting: Several observed campaigns prioritize reconnaissance, fingerprinting targets before delivering more expensive payloads
  • Low operational cost: By leveraging publicly accessible or misconfigured n8n instances, attackers incur minimal infrastructure costs

    • The abuse has proliferated because n8n instances are often deployed with default or weak configurations, insufficient network segmentation, and inadequate monitoring of outbound email activity.


    ## Background and Context


    N8N is a legitimate, popular workflow automation platform used by thousands of organizations to connect business applications, automate repetitive tasks, and integrate data pipelines. It is open-source, self-hostable, and cloud-deployable, making it attractive to enterprises seeking flexible automation without vendor lock-in. Many organizations run n8n instances internally as part of their integration infrastructure.


    However, this flexibility comes with a security cost. When n8n instances are deployed on internet-facing infrastructure without proper authentication, rate limiting, or access controls, they become targets for abuse. Additionally, organizations that run n8n in development or testing environments often use default credentials or disabled authentication—a practice that persists in production through negligence or architectural oversight.


    The platform's webhook system—designed to allow external systems to trigger automated workflows—becomes a liability when exploited. An attacker who gains access to or discovers an unsecured n8n instance can create arbitrary workflows that include email nodes, chain them together, and trigger them repeatedly or on-demand.


    ## Technical Details: How the Attack Chain Works


    The exploitation follows a predictable pattern:


    Step 1: Discovery and Access

    Attackers scan for exposed n8n instances using shodan, censys, or direct HTTP enumeration. Many instances are discoverable because they run on default ports (5678 for local deployment, or via predictable hostnames like n8n.company.com). Once identified, attackers attempt default credentials, check for authentication bypass vulnerabilities, or exploit publicly disclosed CVEs in older n8n versions.


    Step 2: Workflow Creation

    Upon gaining access, the attacker creates a new workflow or modifies an existing one. The workflow typically includes:


  • Trigger node: Webhook listener or manual trigger
  • Template node: Stores phishing email body, crafted with social engineering psychology
  • Variable substitution: Personalizes emails with target names or organizations via CSV import or API calls
  • Email sender node: Dispatches the email using n8n's built-in SMTP capabilities or external email services

    • Step 3: Payload Integration

    The email contains one or more of:


  • Malicious attachments (PDF, Office documents with macros, executables)
  • URLs pointing to credential-stealing landing pages hosted on compromised infrastructure
  • Links triggering drive-by downloads
  • HTML-embedded phishing forms designed to mimic legitimate login pages

    • Step 4: Filter Evasion

    Because the email originates from n8n infrastructure with legitimate reputation signals (SPF/DKIM alignment if the instance has proper DNS configuration), email gateways often permit delivery. The sender address may be spoofed or legitimately tied to a compromised company's n8n instance, making it difficult for recipients to distinguish legitimate workflow notifications from phishing.


    ## Why Traditional Defenses Fail


    The attack succeeds in part because:


  • Trusted infrastructure: Mail filters recognize n8n as a legitimate service and deprioritize scrutiny
  • Volume evasion: Phishing sent at low volumes over time evades reputation-based detection
  • Legitimate-looking origin: Emails appear to originate from a company's own infrastructure if the instance is internal
  • Sophistication payoff: Organizations often trust automation platform output more than external email, reducing user suspicion

    • ## Implications for Organizations


    The abuse of n8n and similar platforms represents a shift in attacker tradecraft. Rather than building or renting dedicated C2 infrastructure, adversaries increasingly weaponize legitimate productivity and automation tools already trusted by organizations and email providers.


    This threatens:


  • Email security: Traditional signature and reputation-based defenses become less reliable
  • Internal trust: Automation platforms become vectors for internally-generated-appearing malware
  • Incident response: Distinguishing legitimate automation activity from malicious workflows requires deep visibility into workflow execution
  • Compliance: Organizations running exploited instances may face breach notification obligations

    • Organizations using n8n are not inherently at risk—the vulnerability lies in deployment practices and access controls, not the platform itself.


    ## Recommendations for Defense


    Organizations deploying n8n or similar automation platforms should implement:


    | Control | Implementation |

    |---------|-----------------|

    | Network segmentation | Restrict n8n to internal networks; use VPN or bastion hosts for external access |

    | Strong authentication | Enforce strong passwords, multi-factor authentication, and OAuth where available |

    | Access logging | Monitor and alert on workflow creation, modification, and email sending activities |

    | Email authentication | Configure strict SPF, DKIM, and DMARC policies to prevent sender spoofing |

    | Outbound email limits | Implement rate limiting on email sending; alert on unusual volume |

    | Patch management | Keep n8n updated to the latest version; subscribe to security advisories |

    | Audit workflows | Regularly review existing workflows for suspicious email-sending nodes or external integrations |

    | Egress filtering | Monitor and restrict outbound SMTP; use a dedicated mail relay with monitoring |


    Additionally, organizations should educate users to scrutinize email claiming to originate from internal automation systems, especially those requesting authentication or containing unusual attachments.


    ## HackWire Analysis


    The exploitation of n8n highlights a fundamental challenge in the modern attack surface: the tools organizations adopt for efficiency and integration become the tools adversaries abuse to deceive and distribute malware. This is not a flaw unique to n8n—similar abuse has occurred with Zapier, Make (formerly Integromat), and other workflow platforms.


    The pattern reflects a broader shift away from bespoke malware infrastructure toward "living off the land" abuse of legitimate platforms. Defenders must move beyond trusting the origin or reputation of a tool and focus instead on monitoring its behavior, restricting its network access, and alerting on anomalous activity. In an environment where attackers can weaponize any platform an organization adopts, vigilance and segmentation are not optional—they are essential.