Tag: cybersecurity

  • VS Code supply chain attack hits GitHub, OpenAI, Mistral AI

    VS Code supply chain attack hits GitHub, OpenAI, Mistral AI

    Key Takeaway

    – Attack exploited developer tooling and supply chain: a poisoned VS Code extension and compromised packages allowed credential theft and broad access without breaching perimeters.
    – Rapid, worm-like propagation: from TanStack package compromise to an Nx Console build, then wider exfiltration across CI/CD pipelines, affecting thousands of repos in minutes.
    – High-severity, cross-vendor impact: targets included GitHub, OpenAI, and Mistral AI, with stolen credentials and internal code assets; some customer data exposure remains a possibility if further impact is discovered.

    News Brief: Supply Chain Attack Targets Developer Tools

    GitHub confirmed today that the breach of roughly 3,800 internal repositories traces back to a poisoned version of the Nx Console VS Code extension, itself a casualty of the TanStack npm supply chain attack. The campaign, attributed to threat actor group TeamPCP and codenamed Mini Shai-Hulud, has now claimed GitHub, OpenAI, and Mistral AI as confirmed victims, with developer credentials and internal source code the primary targets across all three.

    Attack Timeline and Initial Breach

    The attack began on May 11, 2026, when TeamPCP compromised TanStack’s entire router ecosystem, spreading a worm-like payload across 170 npm packages and two PyPI packages in a single coordinated campaign. CVE-2026-45321 carries a CVSS score of 9.6. From there, the compromise reached an Nx Console developer’s device, which TeamPCP used to push a malicious build of Nx Console 18.95.0 to the Visual Studio Marketplace.

    Extension Takedown and Credential Theft

    The trojanized extension was live for exactly 18 minutes, between 12:30 pm and 12:48 pm UTC on May 18, 2026. That window was enough. The extension ran silently on startup, executing a shell command disguised as a routine MCP setup task that downloaded a hidden package from a planted commit on the official Nx GitHub repository. The credential stealer it deployed targeted 1Password vaults, Anthropic Claude code configurations, npm tokens, GitHub tokens, and AWS credentials on any developer machine that installed it during the window.

    Victim Impacts and Responses

    A GitHub employee installed the extension. TeamPCP used the harvested credentials to move through CI/CD pipelines and exfiltrate approximately 3,800 internal repositories. GitHub CISO Alexis Wales confirmed the company has “no evidence of impact to customer information stored outside of GitHub’s internal repositories,” though Wales acknowledged that some internal repos contain excerpts of customer support interactions and committed to notifying customers if any impact is discovered.

    OpenAI and Mistral AI Findings

    OpenAI confirmed two employee devices were compromised, with limited credential material exfiltrated from a subset of internal source code repositories. The company engaged a third-party digital forensics and incident response firm and is revoking its macOS app signing certificate in full on June 12, 2026. Mistral AI confirmed its npm and PyPI SDKs were trojaned as part of the same campaign, with TeamPCP advertising Mistral AI code repositories for sale on a cybercrime forum.

    Common Theme and Expert Insight

    The common factor among all victims is developer tooling. The attack never needed to breach a perimeter. It entered through packages and extensions that developers routinely install, then harvested the credentials those developers use to access everything else. OpenAI framed the implication directly: “This incident reflects a broader shift in the threat landscape — attackers are increasingly targeting shared software dependencies and development tooling rather than any single company.”

    Broader Context and Ongoing Coverage

    The breach lands as Microsoft is simultaneously dealing with its own unpatched vulnerability.

    Sources
    Tags: , , , ,
  • America’s Largest Home Security Company Confirms Data Breach

    America’s Largest Home Security Company Confirms Data Breach

    Key Takeaway

    1. ADT experienced a data breach exposing customer names, phone numbers, addresses, and partial Social Security or Tax ID numbers.
    2. No bank account or payment information was compromised in the breach.
    3. The hacker group ShinyHunters claims to have stolen data from over 10 million customers and is demanding a ransom to prevent leaking the information.
    4. As of now, it is unclear if ADT has responded to the ransom demand.

    Security breach affects major US home security provider

    The biggest home security company in the United States, ADT, recently faced a serious security breach that put many customers at risk. The company confirmed that on April 20, there was a data intrusion, but didn’t specify the exact number of people affected. What’s clear is that sensitive info like customer names, phone numbers, and addresses got stolen, raising alarm among users.

    Details of what was compromised

    In this security lapse, some customers’ last four digits of Social Security Numbers or Tax IDs and their birth dates were also exposed. Fortunately, ADT assured that their bank account details and payment information stayed safe and were not accessed during the breach. The firm stated it has already contacted those impacted to notify them about the situation.

    The hackers behind the attack and their demands

    The hacking group known as ShinyHunters claims responsibility for this breach. They recently revealed on their platform that they stole personal data for more than 10 million customers along with some internal corporate information. They’ve issued a warning that unless ADT pays a ransom, they will leak all the data and cause other digital disruptions.

    Uncertain future and ongoing investigation

    At this point in time, there’s no clear answer whether ADT has responded to ShinyHunters’ ransom demands. The group has set a deadline of April 27, threatening to release the stolen information if their demand isn’t met. As of today, the company and authorities continue to look into this security breach.

    Sources
    Tags: , , ,
  • Take-Two Stock Rises 2.5% as Rockstar Hacker GTA VI Leaks Fail

    Take-Two Stock Rises 2.5% as Rockstar Hacker GTA VI Leaks Fail

    Key Takeaway

    1. The data breach exposed Rockstar’s financial information but did not impact game development or player data, including GTA VI.
    2. Despite releasing the stolen data online, Rockstar’s stock surged, increasing Take-Two Interactive’s valuation by approximately $1 billion.
    3. The incident highlights the effectiveness of Rockstar’s response and investor confidence, with the breach having minimal material impact on the company’s operations or reputation.

    ShinyHunters Hacker Group and Rockstar Incident

    So, ShinyHunters, a dreaded hacker group, took aim at Rockstar Games, demanding a hefty ransom of $200,000. When Rockstar refused to bow down, the hackers made good on their threat and leaked some financial records to the public for free. Surprisingly, instead of causing much trouble, the leak seemed to boost Rockstar’s parent company, Take-Two Interactive. The company’s stock saw a remarkable increase, adding around a billion dollars to its overall worth in just one day. Quite a twist, huh?

    Details About the Data Breach

    Honestly, the hackers said they got into Rockstar’s systems through a tool called Anodot, which monitors Rockstar’s Snowflake cloud servers. After grabbing the data, they wanted $200,000 by April 14, 2026. Rockstar, brave as ever, decided not to pay. In an official statement, they said only a small amount of non-critical company info was accessed because of a third-party breach. Fans didn’t have to worry about their personal details or the new game, Grand Theft Auto VI, being compromised. The leaked info mostly involved earnings from GTA Online and Red Dead Online.

    Financials and Market Impact

    Talking numbers, GTA Online has been raking in about 1.3 million dollars daily since September 2025—adding up to nearly $10 million each week. Over a year, that’s almost $500 million, which is incredible for a game that’s been out for ten years. Meanwhile, Red Dead Online’s earnings were less impressive, but the massive revenue from GTA Online confirms the multiplayer mode is a true cash cow, especially with the popular Shark Cards.

    Stock Market Reaction

    On the day the news broke, the stock of Take-Two Interactive started at $202.60 and had a total market cap of $38 billion. As the day went on, the share price soared over 2.5%, hitting a high of $207.84, boosting the company’s valuation by an estimated billion dollars before falling back slightly to $205.10. This show that despite the hackers’ threats, investors remained confident about the company’s future prospects.

    Final Thoughts

    In the end, it looks like ShinyHunters’ attempt to put pressure on Rockstar didn’t work out how they planned. Instead, Rockstar Games’ reputation and stock seemed to strengthen, and shareholders stayed positive. The company stayed mostly quiet, only confirming that the breach was limited and had no impact on their major projects, including the upcoming launch of Grand Theft Auto VI.

    Sources
    Tags: , , , ,
  • Rockstar Games Faces April 14 Ransom Deadline After Data Leak

    Rockstar Games Faces April 14 Ransom Deadline After Data Leak

    Key Takeaway

    1. Rockstar Games is allegedly targeted in a significant security breach involving the theft of corporate and analytical data via a third-party cloud platform.
    2. The attack leverages supply-chain vulnerabilities, specifically exploiting authentication tokens from Anodot to bypass multi-factor authentication and access Rockstar’s Snowflake environment.
    3. The threat group, ShinyHunters, has a history of targeting major corporations and is also linked to breaches at companies like Amtrak, McGraw Hill, Ticketmaster, AT&T, and Microsoft.

    Recent Security Breach at Rockstar Games

    Rockstar Games experiencing a security breach again, but this time it seems like it might be more targeted at their data systems than the game itself. This follows a notorious 2022 leak where a social engineering trick got early GTA VI footage exposed on Slack. Now, sources say the attack is aimed at their backend servers, possibly exposing sensitive corporate information.

    Threat Group and Their Previous Targets

    ShinyHunters, a known cybercriminal group, is believed to be behind this attack. This group has a history of stealing data from big companies like Ticketmaster, AT&T, and Microsoft. Unlike that lone hacker in 2022, this time they seem to be working as part of a larger campaign, especially attacking companies that use cloud data tools.

    How the Attack Was Carried Out

    Reports from RansomLook.io and CyberSec Guru say the hackers didn’t directly break into Rockstar’s main defenses. Instead, they used an automated process involving a third-party cloud tool called Anodot. By stealing tokens from Anodot’s system, they accessed Snowflake, a company used to store big data like analytics and player info. This way, they could avoid traditional security measures like multi-factor authentication. This sneaky method appears to be a common technique used by ShinyHunters lately.

    Other Victims and Future Risks

    This wave of attacks isn’t just hitting Rockstar. The same group claims they’ve accessed data from Amtrak, McGraw Hill, and over 100 million records from various third-party Salesforce integrations. They’ve set a ransom deadline for April 14, threatening to leak the data if their demands are not fulfilled. So far, Rockstar and its parent company, Take-Two Interactive, haven’t made any statements or disclosures yet, leaving many questions unanswered about the full scope of this incident.


    Sources

    Tags: , , , ,
  • Modder Drives Robot Vacuum with PS5 Controller, Accesses 7,000 Cameras

    Modder Drives Robot Vacuum with PS5 Controller, Accesses 7,000 Cameras

    Key Takeaways

    1. The DJI Romo is the first robot vacuum from DJI, featuring a unique transparent design.
    2. A customer accidentally hacked around 7,000 units, gaining access to their microphones and speakers.
    3. The hack was possible due to DJI’s server improperly accepting a token, revealing serious security flaws.
    4. This incident raises significant concerns about privacy and personal data security in smart home devices.
    5. Strong security measures are essential to protect users from potential threats associated with smart technology.

    The DJI Romo is the first robot vacuum from the well-known drone manufacturer. Its eye-catching transparent design makes it stand out from other similar products. However, it seems that during its creation, not much attention was given to protection against cyber threats. According to The Verge, a customer managed to hack around 7,000 DJI Romo units all over the world by accident.

    An Unexpected Discovery

    Sammy Azdoufal was just trying to have some fun by controlling his robot vacuum using a PlayStation controller. He created a custom app meant to manage the vacuum through DJI’s servers. However, instead of controlling just his own DJI Romo, the server mistakenly allowed him access to almost 7,000 active units at that time. Even more concerning, this means he could access the microphones and speakers of those robots, essentially giving him live access to thousands of homes.

    Serious Security Concerns

    Using the IP address, one could find out the approximate location of each robot, and they could even create maps of the rooms. The programmer stated that he didn’t have to break any laws or hack through security measures to obtain this access. Rather, DJI’s servers improperly accepted the token from his single DJI Romo as a pass to access the data of all devices. On February 11, DJI corrected this significant security issue. Still, this incident highlights how much personal information a smart home device like a robot vacuum can gather, and it raises concerns about how dangerous such a flaw could be if it fell into the wrong hands.

    Implications for Smart Home Devices

    This situation emphasizes the importance of securing smart home devices against potential threats. The amount of personal data collected by these devices is substantial, and incidents like this can lead to serious privacy breaches. As technology continues to evolve, the necessity for robust security measures becomes increasingly clear, ensuring that users can trust their devices without fearing for their personal safety.

    Source:
    Link

     

    Tags: , ,
  • WhatsApp Phone Book: All 3.5 Billion Users Listed by Researchers

    WhatsApp Phone Book: All 3.5 Billion Users Listed by Researchers

    Key Takeaways

    1. Data Collection Vulnerability: Researchers exploited a security flaw in WhatsApp’s contact discovery feature, revealing the identities of 3.5 billion users.

    2. Massive Query Capability: The flaw allowed for the potential lookup of 100 million phone numbers every hour due to a lack of proper rate limits for queries.

    3. Database Creation: The research resulted in a vast database of active WhatsApp accounts, showing publicly accessible metadata like profile photos and last seen details.

    4. Meta’s Response: Meta has implemented strict rate limits to prevent mass queries, although they claim no evidence of prior exploitation exists.

    5. Implications of Shared Keys: Researchers discovered groups of phone numbers sharing the same public key, indicating the use of unofficial software that compromises WhatsApp’s security.

    Security researchers from the University of Vienna and SBA Research have shown a worrying example of how data can be collected on WhatsApp. The team was able to reveal the identities of all 3.5 billion users by utilizing the messenger’s contact discovery feature. This feature is supposed to help users check the contacts in their own address book.

    Exploiting Security Flaws

    The researchers took advantage of a significant security flaw, which has now been patched. They found that the interface lacked proper rate limits for queries. This allowed them to potentially look up a staggering 100 million phone numbers every hour. They simply scanned complete phone number ranges. The study has been shared on GitHub, and the scientists will showcase additional findings and analyses at the Network and Distributed System Security (NDSS) Symposium happening in San Diego from February 23 to 27, 2026.

    A Massive Database of User Accounts

    The results of this research created a vast database containing around 3.5 billion active WhatsApp accounts across the globe. Once a number was verified as registered, WhatsApp’s API (application programming interface) revealed publicly accessible metadata. This included profile photos, status updates, and details about the last time a user was seen online. Technical insights were also available, such as the types of operating systems used. For instance, the data indicates that about 81% of users globally are on Android, while iOS represents about 19%.

    The researchers also looked at this data in relation to the significant Facebook data breach from 2021. Of the numbers leaked during that incident, 58% remain active today. This highlights how valuable large datasets can be, even after a long period. In places with strict internet censorship and bans on WhatsApp, millions of active users were still identified. Specifically, 2,333,519 accounts with Chinese phone numbers were found. Even in North Korea, at least five phone numbers were linked to WhatsApp accounts.

    Meta’s Response to the Issue

    Meta was alerted about the security vulnerability and has since taken steps to enforce strict rate limits, thus preventing mass queries at such speeds. Although the company claims there is no proof that third parties exploited the vulnerability, a thorough review of past attempts is nearly impossible from a technical standpoint. The method used is known among security experts, raising the possibility that it might have been previously used undetected by other parties.

    Additionally, a technical aspect sheds light on the obscure workings of WhatsApp. Typically, each app installation generates a distinct cryptographic key pair necessary for end-to-end encryption and to authenticate the device’s identity. However, the researchers found groups of phone numbers sharing the same public key, which should not be possible with the official app on real devices. This shared key strongly indicates the use of unofficial software. Such tools are often employed in “click farms” or for marketing bots, where operators replicate identical security identities across numerous accounts for efficiency or due to poor implementation. This not only reveals fake accounts but also shows that these unofficial applications can significantly compromise the messenger’s security framework.

    Source:
    Link

     

    Tags: , ,
  • Ubisoft Customer Support Bribes Linked to Rainbow Six Siege Hack

    Ubisoft Customer Support Bribes Linked to Rainbow Six Siege Hack

    Key Takeaways

    1. Ubisoft’s customer support has become a vulnerable area for hackers, with reports of employees accepting bribes to share customer information since 2021.
    2. Account takeovers pose significant risks, potentially leading to server disruptions similar to the recent Rainbow Six Siege incident.
    3. Specific agents in India, South Africa, and Egypt are particularly at risk, as underpaid or poorly trained staff are more susceptible to bribery.
    4. Human error, rather than just database security breaches, is a major threat, with social engineering tactics used to manipulate employees.
    5. Ubisoft has experienced multiple significant cyberattacks over the years, highlighting ongoing vulnerabilities in their security framework, especially within customer support.

    The recent incident involving Rainbow Six Siege is making waves in the news, but it’s not the only situation where hackers have breached Ubisoft’s security. A reputable cybersecurity organization, Vx Underground, has disclosed another security lapse. This breach is separate from the Rainbow Six Siege hack, but it has come to light that Ubisoft’s support team allegedly accepted bribes to share customer information.

    Weakness in Customer Support

    According to Vx Underground, Ubisoft’s customer support has turned into a vulnerable area. Since 2021, they “were reportedly taking money to give hackers access to other users’ Rainbow Six Siege accounts.” Through the customer service portal, these hackers managed to steal sensitive information like full names and IP addresses of users.

    Risks of Account Takeover

    Once hackers gain control of accounts, the potential for harm is enormous. If done on a large scale, this could lead to the kind of disruption that caused the recent suspension of the Rainbow Six Siege servers. Ubisoft has initiated actions to curb employees’ readiness to comply, yet the issue continues to be a pressing worry for the company.

    Vulnerable Agents

    In a social media update, it was pointed out that agents in India, South Africa, and Egypt are especially at risk. Similar to the PlayStation Network incidents, hackers often target underpaid or poorly trained personnel. Bribes appear to be more tempting, especially when other staff members lack the skills to spot suspicious behavior.

    A common explanation for the recent Rainbow Six Siege hack is a breach in database security. However, a FastPassCorp article emphasizes that human error is a larger threat. Social engineering tactics can involve hackers pretending to be customer support representatives or gamers. Even with robust firewalls, it is frequently the employees who fail to identify a threat.

    Ubisoft games have faced significant attacks multiple times, including in 2013 and 2023. However, help desks have consistently been easier targets for cybercriminals. An example highlighted by Vice shows how an individual was able to successfully bribe Roblox support in 2020. Just like the story from Vx Underground, this person managed to alter passwords and sell high-value accounts.

    Conclusion

    In summary, while the Rainbow Six Siege incident is a significant event, it highlights a larger issue within Ubisoft’s security framework. The vulnerabilities in customer support are a major concern that needs to be addressed to prevent further breaches.

    Source:
    Link

     

    Tags: , ,
  • PlayStation Network Hack Exposes Security Flaws and Support Issues

    PlayStation Network Hack Exposes Security Flaws and Support Issues

    Key Takeaways

    1. The PlayStation Network has a history of security breaches, with a major incident occurring in 2011 and ongoing smaller issues.
    2. A journalist experienced a hack that allowed a hacker to change his PSN account email and password, leading to unauthorized charges.
    3. The account recovery process is alarmingly easy, requiring only a username and a transaction number, despite the presence of two-factor authentication (2FA).
    4. After recovering his account, the journalist was hacked again shortly after, highlighting serious security concerns and vulnerabilities in PSN.
    5. Other users, like trophy collector dav1d_123, have faced similar issues, indicating that gamers cannot rely solely on 2FA or PSN’s security measures.

    The PlayStation Network has experienced notable hacks and service interruptions, with the infamous data breach in 2011 being a prime example. Sadly, there have been ongoing smaller security issues. A recent event involving a French journalist demonstrates just how simple it can be to acquire sensitive login information from PSN support.

    Journalist’s Experience

    Nicolas Lellouche, a writer for Numerama, shared his challenges on social media. He explained how a hacker took over his PSN account, changing both the email and password linked to it. Lellouche discovered a charge of €9.99, which was the fee for these changes.

    Recovery Process

    Upon reaching out to support, the journalist found out how easy it was to recover his account. Lellouche simply had to provide his username and a transaction number from a previous bill. Even though the service has two-factor authentication (2FA), it did little to hinder the hacker’s progress.

    Continued Troubles

    Just one hour after getting his account back, Lellouche realized he had been hacked again. Frustrated with PlayStation Network support, he decided to reach out to the hacker. The person was surprisingly friendly, suggesting that a transaction number Lellouche had posted online was the reason for the breach. Still, the hacker preferred to play Call of Duty on the account rather than stop the attacks.

    Lellouche’s latest support request is currently under review as agents look into the situation. While his tale may end on a positive note, it has left readers questioning the security of PlayStation Network even more. A crucial lesson learned is never to disclose account details, even if it’s to guard more sensitive logins. This incident is not the first instance where the company has cooperated with hackers.

    Other Incidents

    In October, a trophy collector known as dav1d_123 had his achievements stolen. Like the journalist from Numerama, he conversed with the thief, who was selling the trophies on the black market. Once again, the hacker only needed to provide a username to convince PSN to transfer ownership.

    It’s clear that gamers cannot depend on 2FA or PlayStation to spot unusual activities. Yet, it’s not just PS5 players who worry about losing digital purchases or facing unexpected charges. An Xbox user recently lost a 15-year collection of games after a hacker changed his email address. In this instance, customer service has been much slower to restore access to the rightful owner.

    Source:
    Link

     

    Tags: , ,
  • Supply Chain Breaches Rise: Marks & Spencer and NHS England Hit

    Supply Chain Breaches Rise: Marks & Spencer and NHS England Hit

    Key Takeaways

    1. In 2024, 30% of cyber incidents were linked to third-party suppliers, doubling from 2023.
    2. Marks & Spencer’s supplier system breach in April 2025 caused significant disruptions and an estimated £300 million profit loss.
    3. Recovery from the Marks & Spencer breach was expected by August 2025, with some services resumed but ongoing product delays.
    4. A ransomware attack on Synnovis in June 2024 led to postponed NHS appointments and was linked to a patient’s death due to delay in blood test results.
    5. The EU’s NIS2 Directive and the UK’s upcoming Cyber Security and Resilience Bill aim to enhance regulations and oversight of supply chains and service providers.

    The Financial Times highlighted that in 2024, 30% of nearly 8,000 cyber incidents were traced back to third-party suppliers. This figure represents a significant increase, doubling from the previous year’s share in 2023.

    Marks & Spencer’s Supplier System Breach

    In April 2025, Marks & Spencer announced that their supplier system had been compromised. This breach caused disruptions in online orders, gift card services, and food logistics. The company estimated that the incident would lead to a profit loss of around £300 million.

    Recovery Timeline

    On July 1, Chief Executive Stuart Machin stated that the majority of the impact would likely be resolved by August. By mid-August, services like Click & Collect and returns were back in operation, although some products still faced delays.

    Ransomware Attack on Synnovis

    In June 2024, Synnovis, a pathology service provider for London NHS trusts, fell victim to a ransomware attack. NHS England reported that thousands of appointments had to be postponed due to the shutdown of diagnostic and transfusion services. The Qilin group claimed responsibility for the attack.

    Serious Consequences

    By June 2025, UK officials confirmed that this incident had a tragic consequence, contributing to a patient’s death because of delayed blood test results.

    New Regulations

    The European Union’s NIS2 Directive became effective in 2024, broadening the rules to include more service providers and mandating improved oversight of supply chains.

    Cyber Security Measures in the UK

    In the UK, a new Cyber Security and Resilience Bill is being prepared to replace the NIS regulations from 2018. This proposed legislation will include managed service providers and data centers under its scope, along with stricter rules for reporting incidents.

    Supply Chain Breaches Rise: Marks & Spencer and NHS England Hit

     

    Tags:
  • Scammers Exploit X’s Grok AI to Distribute Malicious Links

    Scammers Exploit X’s Grok AI to Distribute Malicious Links

    Key Takeaways

    1. Grokking Exploit: Scammers use “Grokking” to hide harmful links in the From field of promoted posts, bypassing link restrictions on X.

    2. System-Trusted Accounts: Grok’s account is seen as “system-trusted,” allowing harmful links to slip past scrutiny and gain visibility.

    3. SEO Boost for Malicious Links: When Grok interacts with a post, it enhances the SEO and domain reputation of the linked content, leading to increased reach.

    4. Dubious Content Promotion: The promoted links often lead to fake captcha scams and malware, exploiting ad networks to monetize clicks.

    5. Evasion of Security Checks: Disguised posts evade X’s review process, lacking any scanning for malicious links, making them difficult to detect.

    Cybersecurity expert Nati Tal, who leads Guardio Labs, has pointed out a new exploit involving Grok AI that enables scammers and threat actors to get around link restrictions on promoted posts, allowing them to share harmful links on X.

    The Grokking Method

    This technique, referred to as “Grokking,” consists of concealing a link in the From field of a paid promotion and prompting Grok to locate the source of that boost. When Grok identifies the link in the From field, it inadvertently includes it in its response, increasing its visibility significantly.

    Tal explains that the reason this tactic is effective is that Grok’s X account is considered “system-trusted,” meaning it does not face the same checks or scrutiny as other accounts. Even more troubling is that these promoted posts gain engagement and rack up “100k to 5M+ impressions” with Grok’s reply appearing underneath.

    SEO and Domain Reputation Boost

    When Grok is invoked to provide an answer, it also enhances the SEO and “domain reputation” of the links, as they are “echoed by Grok on a post with millions of impressions!”

    Tal warns that these links “navigate through dubious ad networks, monetizing clicks with ‘direct links’ known to promote fake captcha scams, info-stealer malware, and other questionable grey-area content.” He emphasizes that this method renders the links “fully visible, clickable, and impossible to miss.”

    Disguised Malicious Content

    The disguised posts are often labeled as “video card” posts, accompanied by “adult content baits” that somehow evade X’s review process. Tal asserts, “There is no scanning for malicious links whatsoever on X! Yet, it is still hardly noticeable at this spot.”

    Interestingly, Grok replied to a user just underneath the post, providing a broken link when the user asked for the correct link to report the issue.

    Source:
    Link

     

    Tags: ,