Hackers Exploit n8n Webhooks to Spread Malware

**Executive Summary:** Between October 2025 and March 2026 Cisco Talos observed a large-scale phishing campaign abusing n8n webhook URLs to deliver malicious executables and MSI installers (including a modified Datto RMM and an Armadillo-packed installer impersonating OneDrive), perform device fingerprinting via tracking pixels, dynamically tailor payloads based on headers (e.g., user-agent), and exfiltrate system data, prompting recommendations to monitor webhook traffic, strengthen email filtering, and educate users.