Cybercriminals Exploit X’s Grok AI to Bypass Ad Protections and Spread Malware to Millions

Cybersecurity researchers have flagged a new technique dubbed Grokking, used by cybercriminals to bypass X’s malvertising protections and spread malicious links via Grok, its AI assistant, according to Guardio Labs researcher Nati Tal. The method works around Promoted Ads restrictions by posting video card-promoted content with an adult bait, hiding the malicious link in the From: metadata below the video, which is not scanned by the platform.

In a subsequent step, fraudsters tag Grok in replies to the post, prompting the AI chatbot to display the link in its response, leading to broad amplification as the post accumulates millions of impressions. Guardio said the malicious links direct users to sketchy ad networks and push information-stealing malware and fake CAPTCHA scams, with the domains organised within a Traffic Distribution System used by malicious ad tech vendors.

The researchers noted hundreds of accounts engaging in this behaviour over the past few days, posting hundreds or thousands of similar posts, and that many accounts appear to operate in a coordinated, non-stop fashion until suspension. 4 September 2025.