Cybercriminals Leverage X’s Grok AI to Circumvent Ad Safeguards and Distribute Malware to Millions
Sep 04, 2025
Artificial Intelligence / Malware
Cybersecurity experts have identified a new tactic employed by cybercriminals to circumvent the malvertising protections of social media platform X, utilizing its AI assistant Grok to disseminate harmful links. This method, dubbed “Grokking,” was discussed in a series of posts by Nati Tal, head of Guardio Labs.
The technique aims to exploit the limitations set by X on Promoted Ads, which typically permit only text, images, or videos for advertising. By leveraging video card-promoted posts featuring adult content as bait, malvertisers cleverly conceal malicious links in the “From:” metadata field located below the video player—an area that goes unchecked by the platform’s security measures.
Artificial Intelligence / Malware
Cybercriminals Exploit X’s Grok AI to Circumvent Ad Protections and Distribute Malware Widely Cybersecurity experts have uncovered a disturbing trend in which cybercriminals are leveraging the artificial intelligence assistant Grok, from the social media platform X, to evade advertising safeguards and disseminate malicious links. This sophisticated method, referred to as…
Cybercriminals Leverage X’s Grok AI to Circumvent Ad Safeguards and Distribute Malware to Millions
Sep 04, 2025
Artificial Intelligence / Malware
Cybersecurity experts have identified a new tactic employed by cybercriminals to circumvent the malvertising protections of social media platform X, utilizing its AI assistant Grok to disseminate harmful links. This method, dubbed “Grokking,” was discussed in a series of posts by Nati Tal, head of Guardio Labs.
The technique aims to exploit the limitations set by X on Promoted Ads, which typically permit only text, images, or videos for advertising. By leveraging video card-promoted posts featuring adult content as bait, malvertisers cleverly conceal malicious links in the “From:” metadata field located below the video player—an area that goes unchecked by the platform’s security measures.