Scammers Are Using Grok to Spread Malicious Links on X

Scammers are using a tactic called “grokking” to spread malicious links on X, bypassing the platform’s ban on links in promoted posts. According to Guardio Labs, grokking lets them reach hundreds of thousands to millions of users by prompt­ing Grok, X’s native AI assistant, to retrieve a link from the From field of video cards and republish it as a fully clickable post.

The technique effectively promotes malicious content, malware, and shady sites at scale, while also boosting the link’s credibility in search engines because it is reposted by a trusted and popular site like X. Guardio researchers, including Shaked Chen who first identified the broader traffic distribution networks, note that hundreds of examples appeared in recent days, with many accounts posting near-identical content until suspension.

The piece, published on 5 September 2025, highlights that a blanket ban on links in promoted posts is imperfect, and calls for comprehensive link scanning across all parts of posts to stop Grok from exposing users to dangerous domains.