Scan incoming Gmail attachments for threats with VirusTotal and GPT-4o-mini
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 13 nodes and runs on Gmail events. Along the way it connects Gmail, OpenAI, Slack and Google Sheets and 1 more.
How it runs
Trigger: On Gmail events.
- Set Configuration (Edit Fields (Set)): sets 5 fields: review_sheet_id, review_sheet_name, security_slack_channel…
- Extract Attachments from Email (Code): runs custom JavaScript code
- Compute SHA256 Hash of Attachment (Code): runs custom JavaScript code
- Wait: waits 15 seconds
- Look Up Hash in VirusTotal (HTTP Request): calls an HTTP API
- Classify Phishing Risk with OpenAI (OpenAI): uses OpenAI
- Calculate Combined Risk Level (Code): runs custom JavaScript code
- Route by Threat Level (Switch): routes items into 3 branches
- Apply Quarantine Label on Gmail (Gmail): add labels
- Log to Review Queue on Google Sheets (Google Sheets): append
…plus 2 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
- Still check Gmail Trigger below v1.4 runs as v1.4 (drafts skipped, max emails per poll) (Poll Gmail for New Attachments).
Nodes used (11)
- Gmail Trigger
n8n-nodes-base.gmailTrigger - Edit Fields (Set)
n8n-nodes-base.set - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - OpenAI
@n8n/n8n-nodes-langchain.openAi - Switch
n8n-nodes-base.switch - Gmail
n8n-nodes-base.gmail - Slack
n8n-nodes-base.slack - Google Sheets
n8n-nodes-base.googleSheets - Google Drive
n8n-nodes-base.googleDrive - Wait
n8n-nodes-base.wait
From the author
Who's it for Small teams, solo operators, and security-conscious individuals who receive email attachments from external senders. Useful for freelancers, agencies, HR teams, and anyone handling CVs, invoices, or documents from unknown sources. How it works…