Secure Email Attachments with AI & VirusTotal for n8n

Stop worrying about malicious email attachments with this intelligent n8n workflow that automatically scans, analyzes, and quarantines threats using AI and VirusTotal integration. Perfect for teams who regularly receive documents from external sources and need automated email security.

What this workflow does

Every minute, this workflow polls your Gmail for new unread emails containing attachments. For each attachment, it calculates a SHA256 hash and queries the VirusTotal API to check for known malware signatures. Simultaneously, an AI model analyzes the email subject and body content to detect phishing patterns and suspicious language.

The workflow uses rule-based scoring to combine both signals into three threat levels: Danger attachments (VirusTotal malicious count ≥3 OR AI detects phishing) are automatically quarantined with a Gmail label and trigger Slack alerts. Suspicious attachments are logged to a Google Sheets review queue for human inspection. Safe attachments are automatically saved to your designated Google Drive folder.

Use cases

• Freelancers and agencies receiving client documents, contracts, and project files
• HR teams processing CVs, resumes, and candidate portfolios from job applicants
• Finance teams handling invoices, receipts, and vendor documentation
• Small businesses managing customer attachments and external communications
• Solo operators who need enterprise-level email security without manual oversight

Technical details

Built with essential n8n nodes including Gmail, Slack, Google Sheets, Google Drive, OpenAI, and VirusTotal integrations. Uses set, code, wait, and switch nodes for intelligent routing and processing logic.

Setup requires a free VirusTotal API key, configured Google Sheet with specific columns for the review queue, Gmail quarantine label, and Google Drive folder for safe storage. The workflow connects six different services through n8n's credential system, with VirusTotal using Header Auth authentication.

Customize threat detection thresholds, notification channels, and quarantine actions to match your security requirements. AI handles only text classification—final quarantine decisions remain rule-based for transparency and control.