Clicking a link on X can feel harmless. A post appears to come from a familiar journalist, a verified company, a popular creator, or that one finance expert whose profile photo features crossed arms and an unusually confident blazer. The preview card shows a recognizable website, the headline sounds believable, and thousands of people have already viewed the post. What could possibly go wrong?
Quite a lot, unfortunately.
Links on X are not automatically dangerous, but neither the appearance of a post nor its link preview guarantees that your browser will reach the website you expect. Attackers can use redirects, compromised accounts, misleading advertisements, shortened URLs, fake login pages, and carefully designed social-engineering messages to turn an ordinary tap into a credential theft attempt, cryptocurrency scam, malware download, or account takeover.
The sensible response is not to unplug the internet and communicate exclusively by carrier pigeon. It is to stop treating every link preview as a promise. On X, a preview card is closer to a movie trailer: polished, persuasive, and not always an accurate description of what happens next.
Why Links on X Deserve Extra Skepticism
A Link Preview May Not Reveal the First Website You Visit
One of the most troubling link problems documented on X involves deceptive preview cards. In a widely reported example, a promoted post appeared to link to Forbes. However, most human visitors who clicked it were sent through another domain and redirected to a Telegram channel associated with questionable cryptocurrency promotions.
The trick worked because the redirecting server treated X’s automated preview crawler differently from an ordinary browser. When X’s crawler inspected the link, the server sent it to a legitimate article, allowing the post to display a trusted domain and professional-looking preview. When a real person clicked, the server sent that visitor somewhere else.
This technique is often called cloaking. The destination shown to an automated system differs from the destination delivered to a human user. The visual preview can therefore look respectable while the actual journey resembles getting into a taxi marked “Public Library” and arriving at “Definitely Legitimate Crypto Palace.”
Mobile Users Cannot Easily Inspect the Destination
Desktop browsers normally let users hover over a link and examine the address shown near the bottom of the window. That is not perfect protection because redirects can still occur, but it provides at least one clue about the first destination.
On the X mobile app, there is no convenient hover function. Users see a card, image, headline, and displayed domain, then tap. By the time the browser reveals the real address, the page may already be loading. Mobile browsing encourages speed, and scammers love speed because careful inspection is the natural predator of fraud.
A Verified Account Is Not a Security Certificate
A checkmark may indicate that an account has a particular subscription or has completed a platform process. It does not prove that every post is trustworthy. The account could be impersonating a public figure, operating under a misleading name, promoting a fraudulent offer, or posting after an attacker obtained access.
Compromised accounts are especially effective because they arrive with history, followers, old conversations, and familiar branding. A malicious post from a newly created account may look suspicious. The same post from an account you have followed for five years can slide past your internal alarm system wearing a fake mustache and carrying the keys to the building.
X itself advises users to be cautious with suspicious links, verify that they are truly on the correct X domain before entering login information, use strong unique passwords, enable two-factor authentication, and avoid giving credentials to services that promise verification, followers, or easy money.
How Malicious X Links Work
Redirect Chains Hide the Final Destination
A link does not always travel directly from X to one website. It may pass through a shortener, advertising tracker, affiliate service, analytics platform, compromised website, or attacker-controlled redirector before reaching its final page.
Redirects have many legitimate uses. Publishers use them to measure traffic, companies use them when pages move, and shorteners make long addresses easier to share. The security problem appears when redirects obscure an attacker-controlled destination or allow different visitors to receive different content.
Open redirects can also borrow the reputation of a legitimate domain. A user may see a recognizable website near the beginning of an address and assume the entire link is safe, even though a parameter at the end instructs that website to forward the browser elsewhere. OWASP warns that unvalidated redirects can support phishing and help attackers bypass checks that rely too heavily on domain reputation.
Fake Login Pages Harvest Credentials
A common malicious link leads to a page that imitates the X login screen. The victim may be told that a post violated copyright rules, the account is scheduled for suspension, verification must be renewed, or an appeal must be filed immediately.
The page asks for a username, password, email address, authentication code, or all four. Anything entered is transmitted to the attacker. Some modern phishing systems relay information to the real service in real time, making the fake page appear functional while helping criminals capture both passwords and temporary authentication codes.
The FBI describes phishing as an attempt to direct victims to convincing fake websites that steal passwords, financial details, and other sensitive information. NIST similarly notes that phishing can arrive through social-media messages, not just email.
Fake Support Messages Create Panic
Scammers frequently impersonate platform support teams. A direct message might claim that your account has been reported, monetization is frozen, or a complaint requires immediate review. The link then opens a fake appeal portal.
The message usually creates urgency because urgency reduces inspection. “Respond within 24 hours” sounds official. “Respond within 14 minutes or your account will be launched into the sun” sounds ridiculous, but people still click when a valuable account or business audience appears to be at risk.
Legitimate account notices should be verified through the platform’s settings, help center, or independently opened website. Do not trust a login page merely because a direct message escorted you there while wearing an imaginary customer-support badge.
Crypto Scams Can Drain More Than a Password
X is heavily used by cryptocurrency communities, which makes it attractive to attackers promoting fake token giveaways, airdrops, refunds, presales, wallet upgrades, and customer-support services.
Some pages simply request a seed phrase, which should never be shared. Others ask users to connect a wallet and approve a transaction. The approval may grant a malicious contract permission to transfer tokens or valuable digital collectibles.
A page does not need your X password to cause financial damage. It may only need one wallet signature that the victim does not fully understand. A colorful “Claim Reward” button can hide a remarkably humorless transaction.
Links Can Lead to Malware or Aggressive Tracking
Credential theft is not the only concern. A malicious destination may encourage visitors to download a browser extension, document, mobile application, security update, video player, or cryptocurrency tool. The file may contain spyware, an information stealer, remote-access software, or other malware.
Even a page that does not install malware may collect useful information such as an IP address, browser type, approximate location, referral data, device characteristics, and whether the visitor appears to be a real person. That information can help scammers refine later attacks.
Google Safe Browsing maintains protections against known phishing, malware, intrusive advertising, and social-engineering sites. However, no warning system can identify every newly created domain immediately. A page can be dangerous before it has accumulated enough reports or evidence to appear on a blocklist.
Red Flags to Check Before Clicking
No single warning sign proves that a link is malicious. The safest approach is to look for combinations of suspicious details.
- Unexpected urgency: The post claims that an account, payment, prize, or investment opportunity will disappear immediately.
- A reward that makes no economic sense: Free cryptocurrency, guaranteed returns, surprise refunds, and exclusive giveaways are favorite bait.
- A request to log in again: Especially suspicious when you were already signed in before opening the link.
- A shortened or unfamiliar domain: Short links are not automatically malicious, but they conceal information you would normally inspect.
- A mismatch between the post and the account: A technology journalist suddenly promoting a token presale deserves investigation.
- Replies are disabled or filled with warnings: Scammers often limit discussion or bury criticism beneath automated responses.
- The page requests a seed phrase or authentication code: Close it. Then close it again emotionally.
- The offer asks you to install software: Obtain applications and updates from the official vendor, not from a social-media promotion.
A Safer Way to Open Links From X
Pause Before Tapping
The most valuable security tool is a brief delay. Read the post again. Ask why the sender wants you to click, whether you expected the message, and whether the request can be verified another way.
CISA highlights urgency, emotional language, requests for sensitive information, and shortened URLs as common phishing indicators. The FTC also recommends resisting pressure and independently researching unexpected offers before clicking or sending money.
Visit the Organization Independently
When a post supposedly links to a bank, government agency, news organization, exchange, or online account, open a fresh browser tab and enter the known address yourself. You can also use a trusted bookmark or official app.
Microsoft and Google both recommend going directly to the organization’s website rather than using a suspicious message’s link. This simple habit breaks the attacker’s carefully constructed path.
Inspect the Entire Domain
Pay attention to the registered domain, not merely familiar words elsewhere in the address. A domain such as x.example-login.com belongs to example-login.com, not X. Likewise, an address containing a famous brand name does not mean that brand owns it.
Watch for swapped letters, added words, unusual subdomains, unexpected country-code endings, and visually similar characters. Attackers know that users skim. Your job is to become temporarily annoying and read the address like a lawyer examining a contract written by raccoons.
Use Browser and Device Protections
Keep the browser, operating system, security software, and mobile applications updated. Enable the browser’s phishing and malware protections. Do not bypass a red warning page merely because the post promised something exciting.
A warning does not mean the browser is ruining your fun. It may be the only participant in the transaction that is not trying to sell you an invisible monkey picture.
Use a Password Manager and Strong Authentication
Password managers help because they normally recognize the domain associated with a saved login. If the password manager refuses to fill your X password, stop and inspect the address instead of manually typing it.
Use a unique password for X and enable strong multifactor authentication. Where available, passkeys or hardware security keys offer stronger phishing resistance than authentication methods that rely on codes a victim can be tricked into entering on a fake page. NIST recommends phishing-resistant authenticators as part of a broader security program.
What to Do After Clicking a Suspicious Link
Clicking does not automatically mean your accounts have been stolen. What happens next depends on the page, your device, and what actions you took.
- Do not enter information. Close the page if it asks for credentials, payment details, a seed phrase, or an authentication code.
- Do not download or open files. Delete unexpected downloads without launching them.
- Change exposed passwords. Use the official website or app, not the suspicious page. Change reused passwords on other services as well.
- Review active sessions. Sign out unknown devices and revoke access granted to unfamiliar third-party applications.
- Secure the connected email account. An attacker controlling your email may be able to reset the X password again.
- Run a security scan. This is especially important if you installed software, opened a downloaded file, or granted unusual permissions.
- Check financial and wallet activity. Contact the relevant institution quickly if payment details or digital assets may be at risk.
- Report the post and account. X says it may block malicious URLs, display warnings, limit their visibility, or act against accounts that repeatedly distribute them.
X acknowledges that harmful links can include malicious redirects, deceptive shorteners, clickjacking links, malware, phishing pages, and destinations associated with platform manipulation. It uses internal tools, reports, outside vendors, and industry partners to identify them, but also notes that links can be miscategorized. In other words, platform defenses help, but they are not a substitute for user judgment.
Does This Mean You Should Never Click Anything on X?
No. Millions of legitimate articles, videos, stores, portfolios, research papers, and public resources are shared on X. The practical lesson is not that every external link is poisonous. It is that the platform’s visual signals should not be treated as proof of safety.
Trust should come from independent verification: the actual domain, the context of the post, the account’s recent behavior, the browser’s warnings, and whether the destination requests an unusual action.
A link to a newspaper article from the newspaper’s established account is lower risk than a promoted post from an unfamiliar account promising a surprise crypto refund. Both deserve inspection, but one is carrying a briefcase while the other is wearing a trench coat full of fireworks.
Field Notes: Experiences and Close Calls Around X Links
The following scenarios reflect recurring patterns documented by security researchers, consumer agencies, and users. They illustrate why the moment after seeing a link matters more than the confidence projected by the post.
The Trusted News Preview That Went Somewhere Else
Imagine scrolling through X and seeing a promoted post that appears to reference a major financial publication. The preview uses the publication’s name, an ordinary headline, and the kind of sober design that practically smells like a newsroom coffee machine. Because the post is promoted and the domain looks familiar, you tap it.
Instead of reaching the expected article, the browser opens a Telegram channel offering cryptocurrency advice. That exact general pattern has been observed: automated preview systems received legitimate content while human visitors were redirected elsewhere.
The experience teaches an uncomfortable lesson. A polished card can represent what X’s crawler saw, not necessarily what every visitor will see. The safest response is to search for the article directly through the publication’s website. An extra ten seconds is cheaper than spending an afternoon explaining to your bank why “Crypto Harry” now owns your weekend.
The Message From a Familiar Account
Another common close call begins with a direct message from someone you know. The message says, “Is this you in this video?” or “Someone is posting photos of you.” Curiosity takes over, and the link opens an X-style login page.
The page looks convincing, but the domain is wrong. The familiar sender did not create the message; the sender’s account was already compromised. The scam spreads by converting each victim into a trusted delivery system for the next group of targets.
This is why recognizing the sender is not enough. If a message feels unusual, confirm it through another channel. Ask the person whether they sent it. A real friend will answer. A hijacked account will continue behaving like a malfunctioning carnival barker.
The Copyright Warning That Wasn’t From X
Creators and businesses often receive fake policy notices. A message claims that a copyright complaint has been filed and that failure to appeal will result in permanent suspension. The included button opens a professional-looking form requesting login credentials and an authentication code.
The emotional pressure is powerful because the account may represent years of work, customers, advertising revenue, or professional reputation. That is exactly why the scam works.
The safer experience begins by refusing the supplied link. Open X independently, review official notifications, and visit the help center through the app or a known address. Security Alliance has documented phishing campaigns that use fake copyright and content-dispute warnings to send X users toward credential-stealing pages.
The Wallet Connection That Became an Expensive Lesson
A user sees a post announcing compensation for network fees. Replies celebrate successful claims, and the account appears active and established. The linked page asks the user to connect a wallet and sign a transaction. Nothing on the screen says “transfer all valuable assets to a stranger,” because marketing departments rarely approve that wording.
The signature grants permissions the user does not understand. Assets begin moving shortly afterward.
The important experience is that cryptocurrency scams often do not resemble traditional password theft. The wallet itself may be functioning correctly. The user voluntarily approved a malicious instruction after being misled about its purpose.
Before signing, inspect the requested permissions, verify the project through independent channels, and consider using a separate wallet with limited funds for unfamiliar applications. A digital signature is not a decorative button. It is closer to signing a contract while somebody holds a flashing sign that says “Free Snacks.”
The Accidental Click That Did Not Become a Disaster
Finally, consider the person who taps a suspicious link, notices the strange address, and closes the page immediately. No password is entered, no file is downloaded, no wallet is connected, and no permissions are granted.
That click may result in nothing more serious than the website recording basic connection information. The user should still review downloads, update the browser, watch for follow-up scams, and run a scan if the page behaved unusually. However, panic can cause additional mistakes, such as installing a fake “cleanup tool” from another untrusted advertisement.
The useful habit is calm containment. Stop interacting with the page, assess what information was exposed, secure affected accounts through official channels, and report the malicious content. Cybersecurity is less like an action movie and more like dealing with spilled coffee: move quickly, but do not throw the laptop through a window.
Conclusion
It is not safe to click links on X blindly because the information displayed in a post can differ from the destination delivered to a real visitor. Redirect cloaking, compromised accounts, fake support notices, deceptive advertisements, credential-harvesting pages, wallet drainers, and malicious downloads all take advantage of the same human weakness: we tend to trust what looks familiar and act before verifying it.
The solution is not permanent suspicion of the entire internet. It is controlled skepticism. Inspect domains, avoid logging in through unexpected links, visit important services independently, use strong authentication, respect browser warnings, and verify unusual messages through another channel.
On X, the safest click is an informed click. Everything else is a small digital leap of faith, and the internet has never been famous for installing safety nets.
