{"success":true,"data":{"id":"n8n-webhook-shared-doc-lure","label":"Fake n8n shared workflow or webhook notification phishing lure","description":"Fake n8n shared workflow / webhook-notification phishing lure. n8n (n8n.io) is a popular open-source and cloud workflow-automation tool used by 50K+ self-hosted instances and 100K+ cloud users. Attackers send emails impersonating the n8n notification system claiming \"Someone shared an n8n workflow with you\" or \"Your n8n webhook has fired — review the execution now\" and directing victims to a credential-harvesting page. The signal fires when: (1) body references the n8n brand AND (2) a shared-workflow / webhook-run / automation-notification narrative is present AND (3) a CTA to click / open / review / accept is present AND (4) sender is NOT from n8n.io. Real n8n workspace-sharing emails originate from @n8n.io with n8n.io DKIM. Source: GC1 R12 council #1; n8n abuse reports 2025; Cofense phishing intelligence Q1 2026.","tier":"danger","category":"other","isThin":false}}