Trusted n8n Subdomains Turn Into Phishing Infrastructure
n8n’s hosted webhooks give attackers a trusted sender identity that standard email filtering does not expect. Free developer accounts create rotating *.app.n8n.cloud subdomains, so abuse can keep changing infrastructure without losing reputation or landing in simple blocklists.
Cisco Talos says this abuse has been running since October 2025 and continued through March 2026. The campaigns used automated emails to deliver malware and fingerprint devices, with phishing volume up 686% in the period Talos tracked.
The risk is not just one bad campaign. Any security control that treats a cloud workflow subdomain as benign can be bypassed, and the trust attached to these hosted domains can persist even after individual malicious workflows are removed.
The n8n n8mare: How threat actors are misusing AI workflow automation
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026.