XChat Flaws Raise Phishing, Scam Concerns

Security researcher ZachXBT has publicly raised concerns about what he describes as “high-risk design flaws” in the early version of X’s new messaging system, XChat. ZachXBT directly alerted X owner Elon Musk to his concerns, outlining how the feature’s current configurations could be exploited for phishing, malware distribution, and crypto scams.

XChat was launched in late May 2025 to upgrade the platform’s direct messaging with encrypted chats and file sharing. While the feature is aimed at enhancing user privacy, ZachXBT has identified several issues that could create a new hostile environment for users. A primary concern is the ability to add users to group chats without their consent. This could allow bad actors to mass-add users to groups and bombard them with phishing campaigns or links to fraudulent crypto projects. The technique mirrors scam tactics that are already common on platforms like Discord and Telegram.

In a separate concern, ZachXBT pointed to the lack of restriction on file transfers via XChat. He warned that malicious files could be sent to users without prior interaction, introducing another vector for scams or wallet-draining attacks. Musk reportedly responded directly to the investigator’s message, though no specific fixes have been confirmed. However, X has not yet reported any incidents directly tied to XChat. Still, researchers claim the current layout shares similarities with older scam methods that have circulated via social media DMs. Such scams often include links to fake token sales, deceptive OTC deals, and fraudulent smart contracts.

ZachXBT also noted that XChat could serve as a new venue for spam bots and hidden promotions. Unlike public posts, private or group chats could be used to distribute links or tokens under the radar, bypassing visible platform moderation. The researcher’s report highlights the potential for these flaws to be exploited, despite the absence of reported incidents so far. The concerns raised by ZachXBT underscore the importance of robust security measures in new features, especially those aimed at enhancing user privacy and communication.