{"id":24404,"date":"2026-05-12T08:30:47","date_gmt":"2026-05-12T01:30:47","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24404"},"modified":"2026-06-23T14:16:23","modified_gmt":"2026-06-23T07:16:23","slug":"when-hackers-dont-need-to-hack-how-n8n-became-a-global-attack-weapon","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/when-hackers-dont-need-to-hack-how-n8n-became-a-global-attack-weapon\/","title":{"rendered":"When Hackers don’t need to hack: How n8n became a global attack weapon"},"content":{"rendered":"

Overview<\/span><\/h2>\n

Cisco Talos analysts have just released a study on a large-scale attack campaign exploiting the n8n workflow automation platform to distribute malware and collect device information (fingerprinting). From January 2025 to March 2026, the number of emails containing malicious webhook links from n8n surged by 686%, indicating that attack groups are actively shifting to abusing trusted service infrastructure (SaaS) to bypass traditional security layers.<\/span><\/p>\n

\"1<\/a><\/span><\/p>\n

The greatest risk lies in malware being executed through “shadow” automation processes\u2014often beyond the control of IT teams. Victims not only have their information stolen but also have unauthorized remote management tools (RMM) installed, setting the stage for future ransomware or espionage attacks. It is crucial to urgently review and tightly control connections to unofficial n8n domains within the enterprise network infrastructure.<\/span><\/p>\n

What is n8n?<\/span><\/h2>\n

\"2<\/a><\/span><\/p>\n

n8n is a workflow automation platform similar to Zapier, specializing in connecting applications and services through APIs (REST\/HTTP). This platform is attracting a large number of users due to its self-hosting capability and built-in tools for creating agentic AI workflows.<\/span><\/p>\n

Architecturally, the n8n system is built on three core components:<\/span><\/p>\n