Cybercriminals using AI on X to lure users into clicking bad links: cybersecurity experts

CHICAGO (WLS) -- The I-Team has uncovered a new online scam targeting users on the social media platform X, formerly known as Twitter. The scheme uses artificial intelligence in a way security experts say most people would never notice.

Security experts call it "Grokking" because scammers use the AI tool known as Grok, through X.

ABC7 Chicago is now streaming 24/7. Click here to watch

And if you're not careful, it could expose your personal information with just one click.

The scam makes dangerous links look legitimate.

"They actually manipulated Grok to spell out that malicious link and echo them in the system," said Nati Tal, head of security for Guardio.

The goal is simple: Trick users by putting malicious links that look trustworthy at the very top of a conversation thread on X.

"Unfortunately, bad actors and scammers in this case always find a creative way to abuse those kinds of achievements of humanity," Tal said.

Cybersecurity experts at Gaurdio say cybercriminals first post a "promoted" video, usually explicit, with a malicious link embedded in the video metadata.

SEE ALSO: Boys at her school shared AI-generated, nude images of her. She was the one expelled

The scammers ask Grok in the thread, "Where is this video from?" Then, Grok finds the source of the video, which is that malicious link. And scammers get Grok to put that link in the thread reply.

Those phishing links are luring people to click, and then can install malware on your device, or trick you into giving up personal information.

ABC7 Chicago alerted the X platform about the potential issue. The company's only reply to the I-Team was that it isn't true, despite what security experts pointed out.

"And being promoted to millions and millions of people on X, millions of people see them on their feed on X," Tal said.

Security experts say never click a link generated by Grok inside a promoted video thread.

You can see the links that Grok creates because it's in the "Grok" reply.

Experts also recommend antivirus protection and reporting suspicious posts directly to X.