Threat actors have been abusing n8n workflows since October 2025 to deliver malware via trusted automation platforms. Here's how to detect it and protect.

n8n Webhooks Weaponized: How Indian SMBs Can Defend Against This Attack

What Happened

Since October 2025, threat actors have been systematically exploiting n8n — a popular open-source workflow automation platform — to launch sophisticated phishing campaigns and deliver malicious payloads. By weaponizing n8n's webhook functionality, attackers bypass traditional email security filters by sending emails from trusted infrastructure, making their campaigns far more effective than conventional phishing attempts.

The attack works deceptively simple: attackers compromise or create n8n instances, configure automated workflows with webhook triggers, and use them to send targeted phishing emails with malware attachments or credential-stealing links. Because the emails originate from legitimate automation platforms rather than attacker-controlled servers, they evade spam filters, DMARC checks, and endpoint security tools that typically flag suspicious email sources.

What makes this particularly dangerous is the dual-purpose nature of the attack. Threat actors aren't just delivering malware — they're also using n8n workflows to fingerprint devices, gather system information, and profile potential victims before launching secondary attacks. This reconnaissance-first approach means infections are highly targeted and effective.

October 2025Attack campaign start date

6+ monthsDuration of active exploitation

UnknownNumber of affected organizations

Trusted platformsPrimary delivery vector bypassing filters

Why This Matters for Indian Businesses

In my years building enterprise systems for Fortune 500 companies, I've seen a consistent pattern: attackers always follow the path of least resistance. For Indian SMBs, that path is increasingly through trusted third-party tools and automation platforms.

The n8n webhook abuse is particularly relevant to Indian businesses for several reasons:

1. DPDP Act Compliance Risk The Digital Personal Data Protection (DPDP) Act, 2023 makes organizations accountable for data breaches. If your business uses n8n for workflow automation and attackers compromise it to steal customer data or employee information, you're liable for notification, investigation, and potential penalties. The Act requires breach notification within 72 hours to affected individuals.

2. CERT-In Reporting Mandate India's Computer Emergency Response Team (CERT-In) requires organizations to report significant cybersecurity incidents within 6 hours. A compromised n8n instance leading to malware distribution or data theft triggers this obligation. Failure to report incurs penalties under the Information Technology Act, 2000.

3. RBI Guidelines for Financial Services If your business handles payments or financial data, the Reserve Bank of India (RBI) expects robust third-party risk management. Using n8n without proper security controls violates the RBI's Cyber Security Framework for banks and fintech companies.

4. Supply Chain Attack Vector Many Indian SMBs use n8n to automate customer communication, invoice delivery, and order processing. A compromised workflow doesn't just expose your data — it weaponizes your business to attack your customers, damaging trust and creating legal liability.

⚠️

WARNING

If your n8n instance is internet-facing with public webhooks, attackers can abuse it to send phishing emails appearing to come from your domain, violating DPDP Act requirements and CERT-In reporting mandates.

Technical Breakdown

How the Attack Works

graph TD
    classDef default fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    classDef danger fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    classDef success fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    A[Attacker Identifies Target] -->|reconnaissance| B[Creates/Compromises n8n Instance]
    B -->|configures webhook| C[Sets Up Automated Email Workflow]
    C -->|triggers on webhook| D[Sends Phishing Email from Trusted IP]
    D -->|bypasses filters| E[Email Reaches Target Inbox]
    E -->|user clicks| F[Malware Installation or Credential Theft]
    F -->|fingerprinting| G[Device Profiling and Reconnaissance]
    G -->|lateral movement| H[Secondary Attack or Data Exfiltration]

Attack Vector Details

Step 1: Initial Access Attackers gain access to n8n instances through:

Weak credentials on publicly exposed n8n dashboards
Unpatched vulnerabilities in n8n or its dependencies
Compromised API keys or authentication tokens
Social engineering targeting n8n administrators

Step 2: Webhook Configuration Once inside, attackers create HTTP webhook triggers that accept POST requests. These webhooks are configured to:

Accept email parameters (sender, recipient, subject, body, attachments)
Use n8n's built-in email nodes (Gmail, Sendgrid, SMTP connectors)
Execute on external triggers from attacker-controlled sources

Step 3: Phishing Campaign Launch Attackers send POST requests to their webhook with phishing payloads:

bash

curl -X POST https://target-n8n-instance.com/webhook/phishing-campaign \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": "victim@company.com",
    "subject": "Urgent: Account Verification Required",
    "body": "Click here to verify your account: https://attacker.com/fake-login",
    "attachment_url": "https://attacker.com/malware.exe",
    "sender_name": "IT Department"
  }'

Step 4: Filter Bypass Because emails originate from n8n's infrastructure (legitimate IP ranges), they bypass:

Spam filters (n8n is a trusted platform)
DMARC/SPF/DKIM checks (if configured to use n8n's sending domain)
URL reputation filters (legitimate platform with credential-stealing links)
Attachment sandboxing (malware embedded in trusted workflow)

Step 5: Fingerprinting and Profiling Attackers embed tracking pixels and JavaScript beacons in phishing emails to:

Confirm email delivery and opening
Capture browser version, OS, installed software
Detect security tools (antivirus, EDR, VPN)
Profile the victim for secondary attacks

Real-World Example: Indian E-Commerce Attack

Imagine an Indian e-commerce SMB using n8n to send order confirmations. An attacker:

Compromises the n8n instance via weak credentials
Creates a workflow that mirrors legitimate order emails
Sends phishing emails to customers: "Your order payment failed — update payment method here"
Customers click the link (appears to come from their trusted vendor)
Credentials stolen, malware installed
Customer data exfiltrated, leading to DPDP Act violation

🛡️

SECURITY

The danger here is trust exploitation. Users are far more likely to click malicious links in emails from automation platforms they recognize than from unknown senders.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

How to Protect Your Business

Protection Layer	Action	Difficulty
Access Control	Enforce strong passwords (16+ chars, MFA) on n8n admin accounts	Easy
Network Security	Restrict n8n dashboard access to specific IPs only; disable public exposure	Easy
Webhook Validation	Implement request signing (HMAC-SHA256) to verify webhook sources	Medium
Email Authentication	Configure DMARC, SPF, DKIM to prevent domain spoofing via n8n	Medium
Audit Logging	Enable detailed logging of all workflow executions and modifications	Medium
Segmentation	Isolate n8n instances from production databases and customer data	Hard
Vulnerability Scanning	Regular VAPT of n8n infrastructure and connected systems	Medium
Employee Training	Phishing simulations to educate teams on n8n-origin attacks	Easy

Quick Fix: Secure Your n8n Instance Now

1. Change Default Credentials

bash

# SSH into your n8n server
ssh admin@your-n8n-server.com

# Stop n8n
sudo systemctl stop n8n

# Update credentials in .env file
sudo nano /home/n8n/.env

# Add these lines:
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=your-secure-username
N8N_BASIC_AUTH_PASSWORD=$(openssl rand -base64 32)

# Restart n8n
sudo systemctl start n8n

2. Restrict Webhook Access

bash

# In n8n UI, for each webhook node:
# 1. Go to Workflow → Webhook Node Settings
# 2. Add authentication: "Predefined Auth → API Key"
# 3. Generate random API key
# 4. Share key only with authorized systems

# Example webhook URL with authentication:
https://your-n8n.com/webhook/secure-workflow?auth=your-api-key-here

3. Enable DMARC for Webhook-Sent Emails

bash

# Add to your DNS records (replace example.com with your domain):
# TXT record for DMARC:
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; fo=1

# This rejects emails claiming to be from your domain but sent via n8n's infrastructure
# Configure n8n to use a subdomain instead:
# noreply@notifications.example.com (separate from main domain)

4. Audit All Active Workflows

bash

# Log into n8n and review:
# 1. Executions tab → Check for unexpected workflow runs
# 2. Workflows tab → Verify each workflow's purpose
# 3. Credentials tab → Ensure only authorized connections exist
# 4. Look for workflows that send emails to external recipients

💡

TIP

Set up webhook request signing to ensure only your authorized systems can trigger n8n workflows. Use HMAC-SHA256 validation to verify request authenticity before execution.

How Bachao.AI by Dhisattva AI Pvt Ltd Detects This

When I founded Bachao.AI, I saw hundreds of Indian SMBs using third-party automation tools without visibility into their security posture. This n8n attack is exactly why we built our products.

Ready to protect your business? Visit Bachao.AI for a comprehensive security assessment of your applications and infrastructure.

What We Check

Our VAPT process specifically looks for:

1. Network Exposure
   ✓ Is n8n dashboard accessible from the internet?
   ✓ Are webhook URLs publicly discoverable?
   ✓ Is authentication enforced?

2. Credential Security
   ✓ Are admin passwords strong (16+ chars, complexity)?
   ✓ Is MFA enabled on n8n accounts?
   ✓ Are API keys rotated regularly?

3. Workflow Integrity
   ✓ Are email workflows logging all executions?
   ✓ Can unauthorized users create/modify workflows?
   ✓ Are webhook sources validated?

4. Data Protection
   ✓ Are customer emails/data exposed in workflows?
   ✓ Are credentials stored securely in n8n?
   ✓ Is data encrypted in transit to email providers?

5. Compliance
   ✓ Are audit logs retained for CERT-In investigations?
   ✓ Is DPDP Act breach notification possible within 72 hours?
   ✓ Are third-party data processors (n8n) documented?

Action Items for Your Business

This Week:

Change all n8n admin passwords to 16+ character, randomly generated strings
Enable MFA on every n8n account
Audit all active workflows — disable any you don't recognize
Review webhook execution logs for suspicious activity

This Month:

Restrict n8n dashboard access to your office IP or VPN only
Implement DMARC/SPF/DKIM for domains used in n8n email workflows
Set up request signing (HMAC) for all webhook triggers
Run a VAPT scan to identify vulnerabilities

Ongoing:

Monthly workflow audits to catch unauthorized changes
Quarterly credential rotation for n8n service accounts
Employee phishing training focused on automation-platform attacks
Monitor n8n security advisories and apply patches within 48 hours

ℹ️

INFO

As an Indian SMB, you're likely using n8n to automate customer communication, invoicing, or order processing. This attack directly threatens your customers' data and your DPDP Act compliance. Act now.

Final Thoughts

As someone who's reviewed hundreds of Indian SMB security postures, I've noticed a pattern: we're all racing to adopt automation tools to stay competitive, but we're not securing them at the same speed. n8n is a fantastic platform — but like any powerful tool, it's only secure if you use it responsibly.

The organizations that will survive this threat are the ones that treat third-party tools with the same rigor as their own infrastructure. That means strong access controls, audit logging, and regular security testing.

This is exactly why I built Bachao.AI — to make enterprise-grade security accessible to Indian SMBs without the enterprise price tag.

Book Your Free VAPT Scan →

We'll identify if your n8n instance is at risk, and provide a detailed report with remediation steps.

Originally reported by The Hacker News

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

Frequently Asked Questions

Q: What is n8n and why do Indian businesses use it? A: n8n is an open-source workflow automation platform enabling businesses to connect applications and automate processes. Indian SMBs use it for CRM updates, customer notifications, invoice processing, and data synchronisation between tools — often without dedicated developer support.

Q: What makes n8n webhooks a security risk? A: Unauthenticated or publicly exposed n8n webhook URLs allow anyone who discovers them to trigger your workflows. Attackers can abuse this to initiate data exports, send fraudulent notifications, exhaust API quotas, or inject malicious data into your business processes.

Q: How can attackers discover my n8n webhook URLs? A: Common methods include web crawling, GitHub/GitLab secret scanning if URLs are committed to code, employee phishing, Shodan/Censys scanning for exposed n8n instances, and monitoring traffic between integrated services.

Q: What is the single most important n8n security setting to enable? A: Enable authentication on all webhook nodes using Basic Auth or Header Auth. Never expose n8n directly to the internet without authentication. Combine this with network-level access controls and IP allowlisting where possible.

Q: How does Bachao.AI help secure automation platforms like n8n? A: Bachao.AI's VAPT scan includes API endpoint discovery and authentication testing, identifying unauthenticated webhooks, exposed admin interfaces, and credential leakage in automation configurations. Visit Bachao.AI to assess your automation security posture.

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

What Happened

October 2025Attack campaign start date

6+ monthsDuration of active exploitation

UnknownNumber of affected organizations

Trusted platformsPrimary delivery vector bypassing filters

Why This Matters for Indian Businesses

The n8n webhook abuse is particularly relevant to Indian businesses for several reasons:

⚠️

WARNING

Technical Breakdown

How the Attack Works

graph TD
    classDef default fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    classDef danger fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    classDef success fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    A[Attacker Identifies Target] -->|reconnaissance| B[Creates/Compromises n8n Instance]
    B -->|configures webhook| C[Sets Up Automated Email Workflow]
    C -->|triggers on webhook| D[Sends Phishing Email from Trusted IP]
    D -->|bypasses filters| E[Email Reaches Target Inbox]
    E -->|user clicks| F[Malware Installation or Credential Theft]
    F -->|fingerprinting| G[Device Profiling and Reconnaissance]
    G -->|lateral movement| H[Secondary Attack or Data Exfiltration]

Attack Vector Details

Step 1: Initial Access Attackers gain access to n8n instances through:

Weak credentials on publicly exposed n8n dashboards
Unpatched vulnerabilities in n8n or its dependencies
Compromised API keys or authentication tokens
Social engineering targeting n8n administrators

Step 2: Webhook Configuration Once inside, attackers create HTTP webhook triggers that accept POST requests. These webhooks are configured to:

Accept email parameters (sender, recipient, subject, body, attachments)
Use n8n's built-in email nodes (Gmail, Sendgrid, SMTP connectors)
Execute on external triggers from attacker-controlled sources

Step 3: Phishing Campaign Launch Attackers send POST requests to their webhook with phishing payloads:

bash

curl -X POST https://target-n8n-instance.com/webhook/phishing-campaign \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": "victim@company.com",
    "subject": "Urgent: Account Verification Required",
    "body": "Click here to verify your account: https://attacker.com/fake-login",
    "attachment_url": "https://attacker.com/malware.exe",
    "sender_name": "IT Department"
  }'

Step 4: Filter Bypass Because emails originate from n8n's infrastructure (legitimate IP ranges), they bypass:

Spam filters (n8n is a trusted platform)
DMARC/SPF/DKIM checks (if configured to use n8n's sending domain)
URL reputation filters (legitimate platform with credential-stealing links)
Attachment sandboxing (malware embedded in trusted workflow)

Step 5: Fingerprinting and Profiling Attackers embed tracking pixels and JavaScript beacons in phishing emails to:

Confirm email delivery and opening
Capture browser version, OS, installed software
Detect security tools (antivirus, EDR, VPN)
Profile the victim for secondary attacks

Real-World Example: Indian E-Commerce Attack

Imagine an Indian e-commerce SMB using n8n to send order confirmations. An attacker:

Compromises the n8n instance via weak credentials
Creates a workflow that mirrors legitimate order emails
Sends phishing emails to customers: "Your order payment failed — update payment method here"
Customers click the link (appears to come from their trusted vendor)
Credentials stolen, malware installed
Customer data exfiltrated, leading to DPDP Act violation

🛡️

SECURITY

The danger here is trust exploitation. Users are far more likely to click malicious links in emails from automation platforms they recognize than from unknown senders.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

How to Protect Your Business

Protection Layer	Action	Difficulty
Access Control	Enforce strong passwords (16+ chars, MFA) on n8n admin accounts	Easy
Network Security	Restrict n8n dashboard access to specific IPs only; disable public exposure	Easy
Webhook Validation	Implement request signing (HMAC-SHA256) to verify webhook sources	Medium
Email Authentication	Configure DMARC, SPF, DKIM to prevent domain spoofing via n8n	Medium
Audit Logging	Enable detailed logging of all workflow executions and modifications	Medium
Segmentation	Isolate n8n instances from production databases and customer data	Hard
Vulnerability Scanning	Regular VAPT of n8n infrastructure and connected systems	Medium
Employee Training	Phishing simulations to educate teams on n8n-origin attacks	Easy

Quick Fix: Secure Your n8n Instance Now

1. Change Default Credentials

bash

# SSH into your n8n server
ssh admin@your-n8n-server.com

# Stop n8n
sudo systemctl stop n8n

# Update credentials in .env file
sudo nano /home/n8n/.env

# Add these lines:
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=your-secure-username
N8N_BASIC_AUTH_PASSWORD=$(openssl rand -base64 32)

# Restart n8n
sudo systemctl start n8n

2. Restrict Webhook Access

bash

# In n8n UI, for each webhook node:
# 1. Go to Workflow → Webhook Node Settings
# 2. Add authentication: "Predefined Auth → API Key"
# 3. Generate random API key
# 4. Share key only with authorized systems

# Example webhook URL with authentication:
https://your-n8n.com/webhook/secure-workflow?auth=your-api-key-here

3. Enable DMARC for Webhook-Sent Emails

bash

# Add to your DNS records (replace example.com with your domain):
# TXT record for DMARC:
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; fo=1

# This rejects emails claiming to be from your domain but sent via n8n's infrastructure
# Configure n8n to use a subdomain instead:
# noreply@notifications.example.com (separate from main domain)

4. Audit All Active Workflows

bash

# Log into n8n and review:
# 1. Executions tab → Check for unexpected workflow runs
# 2. Workflows tab → Verify each workflow's purpose
# 3. Credentials tab → Ensure only authorized connections exist
# 4. Look for workflows that send emails to external recipients

💡

TIP

Set up webhook request signing to ensure only your authorized systems can trigger n8n workflows. Use HMAC-SHA256 validation to verify request authenticity before execution.

How Bachao.AI by Dhisattva AI Pvt Ltd Detects This

When I founded Bachao.AI, I saw hundreds of Indian SMBs using third-party automation tools without visibility into their security posture. This n8n attack is exactly why we built our products.

Ready to protect your business? Visit Bachao.AI for a comprehensive security assessment of your applications and infrastructure.

What We Check

Our VAPT process specifically looks for:

1. Network Exposure
   ✓ Is n8n dashboard accessible from the internet?
   ✓ Are webhook URLs publicly discoverable?
   ✓ Is authentication enforced?

2. Credential Security
   ✓ Are admin passwords strong (16+ chars, complexity)?
   ✓ Is MFA enabled on n8n accounts?
   ✓ Are API keys rotated regularly?

3. Workflow Integrity
   ✓ Are email workflows logging all executions?
   ✓ Can unauthorized users create/modify workflows?
   ✓ Are webhook sources validated?

4. Data Protection
   ✓ Are customer emails/data exposed in workflows?
   ✓ Are credentials stored securely in n8n?
   ✓ Is data encrypted in transit to email providers?

5. Compliance
   ✓ Are audit logs retained for CERT-In investigations?
   ✓ Is DPDP Act breach notification possible within 72 hours?
   ✓ Are third-party data processors (n8n) documented?

Action Items for Your Business

This Week:

Change all n8n admin passwords to 16+ character, randomly generated strings
Enable MFA on every n8n account
Audit all active workflows — disable any you don't recognize
Review webhook execution logs for suspicious activity

This Month:

Restrict n8n dashboard access to your office IP or VPN only
Implement DMARC/SPF/DKIM for domains used in n8n email workflows
Set up request signing (HMAC) for all webhook triggers
Run a VAPT scan to identify vulnerabilities

Ongoing:

Monthly workflow audits to catch unauthorized changes
Quarterly credential rotation for n8n service accounts
Employee phishing training focused on automation-platform attacks
Monitor n8n security advisories and apply patches within 48 hours

ℹ️

INFO

Final Thoughts

This is exactly why I built Bachao.AI — to make enterprise-grade security accessible to Indian SMBs without the enterprise price tag.

Book Your Free VAPT Scan →

We'll identify if your n8n instance is at risk, and provide a detailed report with remediation steps.

Originally reported by The Hacker News

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

Frequently Asked Questions

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

n8n Webhooks Weaponized: How Indian SMBs Can Defend Against This Attack

What Happened

Why This Matters for Indian Businesses

Technical Breakdown

How the Attack Works

Attack Vector Details

Real-World Example: Indian E-Commerce Attack

How to Protect Your Business

Quick Fix: Secure Your n8n Instance Now

How Bachao.AI by Dhisattva AI Pvt Ltd Detects This

What We Check

Action Items for Your Business

Final Thoughts

Frequently Asked Questions

Bachao.AI Research Team

Get cybersecurity insights for Indian SMBs

Related Articles

Critical CrowdStrike & Tenable Flaws: What Indian SMBs Must Know

AI Model Theft & IP Exfiltration: What Indian SMBs Must Know

Cisco Firewall Backdoor 'Firestarter': What Indian SMBs Must Know

Ready to secure your business?

n8n Webhooks Weaponized: How Indian SMBs Can Defend Against This Attack

What Happened

Why This Matters for Indian Businesses

Technical Breakdown

How the Attack Works

Attack Vector Details

Real-World Example: Indian E-Commerce Attack

How to Protect Your Business

Quick Fix: Secure Your n8n Instance Now

How Bachao.AI by Dhisattva AI Pvt Ltd Detects This

What We Check

Action Items for Your Business

Final Thoughts

Frequently Asked Questions

Bachao.AI Research Team

Get cybersecurity insights for Indian SMBs

Related Articles

Critical CrowdStrike & Tenable Flaws: What Indian SMBs Must Know

AI Model Theft & IP Exfiltration: What Indian SMBs Must Know

Cisco Firewall Backdoor 'Firestarter': What Indian SMBs Must Know

Ready to secure your business?