Trusted n8n Subdomains Turn Into Phishing Infrastructure
n8n’s hosted webhooks give attackers a trusted sender identity that standard email filtering does not expect. Free developer accounts create rotating *.app.n8n.cloud subdomains, so abuse can keep changing infrastructure without losing reputation or landing in simple blocklists.
Cisco Talos says this abuse has been running since October 2025 and continued through March 2026. The campaigns used automated emails to deliver malware and fingerprint devices, with phishing volume up 686% in the period Talos tracked.
The risk is not just one bad campaign. Any security control that treats a cloud workflow subdomain as benign can be bypassed, and the trust attached to these hosted domains can persist even after individual malicious workflows are removed.