Key Takeaways
1. Grokking Exploit: Scammers use “Grokking” to hide harmful links in the From field of promoted posts, bypassing link restrictions on X.
2. System-Trusted Accounts: Grok’s account is seen as “system-trusted,” allowing harmful links to slip past scrutiny and gain visibility.
3. SEO Boost for Malicious Links: When Grok interacts with a post, it enhances the SEO and domain reputation of the linked content, leading to increased reach.
4. Dubious Content Promotion: The promoted links often lead to fake captcha scams and malware, exploiting ad networks to monetize clicks.
5. Evasion of Security Checks: Disguised posts evade X’s review process, lacking any scanning for malicious links, making them difficult to detect.
Cybersecurity expert Nati Tal, who leads Guardio Labs, has pointed out a new exploit involving Grok AI that enables scammers and threat actors to get around link restrictions on promoted posts, allowing them to share harmful links on X.
The Grokking Method
This technique, referred to as “Grokking,” consists of concealing a link in the From field of a paid promotion and prompting Grok to locate the source of that boost. When Grok identifies the link in the From field, it inadvertently includes it in its response, increasing its visibility significantly.
Tal explains that the reason this tactic is effective is that Grok’s X account is considered “system-trusted,” meaning it does not face the same checks or scrutiny as other accounts. Even more troubling is that these promoted posts gain engagement and rack up “100k to 5M+ impressions” with Grok’s reply appearing underneath.
SEO and Domain Reputation Boost
When Grok is invoked to provide an answer, it also enhances the SEO and “domain reputation” of the links, as they are “echoed by Grok on a post with millions of impressions!”
Tal warns that these links “navigate through dubious ad networks, monetizing clicks with ‘direct links’ known to promote fake captcha scams, info-stealer malware, and other questionable grey-area content.” He emphasizes that this method renders the links “fully visible, clickable, and impossible to miss.”
Disguised Malicious Content
The disguised posts are often labeled as “video card” posts, accompanied by “adult content baits” that somehow evade X’s review process. Tal asserts, “There is no scanning for malicious links whatsoever on X! Yet, it is still hardly noticeable at this spot.”
Interestingly, Grok replied to a user just underneath the post, providing a broken link when the user asked for the correct link to report the issue.
Source:
Link













