Scammers hide malware in metadata, ask Grok 'Where's this from?' to amplify it