Volcanic hazards increase exponentially during periods of unrest. At present, it is difficult to discern whether magmatic intrusions or hydrothermal activity are the primary drivers of volcanic (re)awakening. This uncertainty complicates hazard mitigation and risk reduction strategies, ultimately influencing civil protection decisions and evacuation plans. In 2021, Vulcano, Italy, entered in unrest, featuring for the first time the occurrence of very long period (VLP) seismic events, which are frequently associated with magma motion at depth. The proposed causative VLPs models are non-unique and advocate either magmatic or hydrothermal activity. We deployed a dense nodal seismic network of 196 3C sensors during the unrest of Vulcano to image the source of deformation thanks to the inversion of seismic ambient noise data. We show that high-resolution Nodal Ambient Noise Tomography (NANT) can accurately identify regions of magma occurrence at depth and help discriminating between magmatic and hydrothermal drivers of unrest. We identify a sub-horizontal intrusion migrating northwards below the vertical projection of the VLP source location, which we suggest may be the causative source of deformation. The deployment of NANT during volcanic unrest, if rapidly processed, can map the distribution of S-wave anomalies and constrain the velocity structure of the regions undergoing major deformations. This approach has the potential to transform static evacuation plans into dynamic and source-dependent hazard mitigation schemes that may ultimately save lives.