According to Cisco Talos, it's these URL-exposed webhooks – which make use of the same *.app.n8n [.]cloud subdomain – that ...

Cyber attackers are abusing the low-code automation platform n8n to push malware and track targets through phishing emails, in a campaign that security researchers say gathered pace between October ...

You cannot go wrong with this stack.