Cybercriminals exploit Grok AI on X to spread malware via promoted ads
Cybercriminals have developed an attack technique called "Grokking" that exploits X's Grok AI chatbot to amplify malicious links in promoted advertisements. The scheme hides malicious URLs in metadata fields to bypass platform security filters, then uses Grok to display the links in replies, leveraging the AI's trusted status to reach millions of users.
What happened
Cybercriminals developed an attack technique called 'Grokking' that exploits X's Grok AI chatbot to amplify malicious links in promoted advertisements. Threat actors first launch deceptive promoted video ads, typically using adult content as bait, with malicious URLs embedded in the 'From:' metadata field of the ad's video card rather than the main ad body to evade X's automated scanning.
In the second stage, threat actors post replies to their own ads that prompt Grok AI by asking questions like 'What is the link to this video?' This causes Grok to parse the ad's metadata content and reply with the full, clickable malicious link. Because Grok is an integrated and trusted system account, its replies are algorithmically boosted and given more credibility, effectively legitimizing the malicious links and increasing user click-through rates.
Reported impact
The malicious links distributed through this scheme typically redirect users to various scams via ad networks, including fraudulent CAPTCHA verifications, infostealers, and other dangerous payloads. Some campaigns using this technique have achieved millions of impressions.
Index analysis
The attack exploits Grok's trusted status and algorithmic amplification on the X platform to bypass security filters that would normally detect and block malicious content. The scheme specifically manipulates the AI's content parsing capabilities to extract and display hidden malicious URLs from metadata fields that platform security protocols apparently do not scrutinize.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.