Kakushie: The Viral X Hidden-Image Trend and the CSAM Safety Risk Regulators Are Watching

How the Technical Exploit Works

The trick exploits a specific interaction between transparent PNG alpha channels and X's mobile image viewer:

1. PNG-8 with transparency — The creator exports an image as a PNG-8 (8-bit) with an alpha channel, where selected areas are made fully transparent or partially transparent using an eyedropper tool.
2. X's timeline compression — When displayed in the main timeline feed, X's image pipeline renders the PNG with its transparency intact, making large transparent or semi-transparent areas appear faint, garbled, or nearly blank.
3. The tap/hold reveal — On the X mobile app, tapping the image opens a full-screen viewer. Holding the press triggers X to load a higher-resolution or "4K" version of the image. At that point, the transparency data is rendered differently, and the hidden picture "snaps" into full visibility. On iOS, users may need to tap "Load in 4K" if prompted.

This is not a security vulnerability or a hack in the traditional steganography sense — it is a deliberate exploitation of X's two-stage image rendering pipeline (thumbnail vs. full-resolution viewer). The platform does not apply the same compression or alpha-channel handling in the full-screen view as it does in the timeline, which creates the reveal effect.

Safety Concerns: CSAM and Inappropriate Content

No direct evidence has yet surfaced specifically linking kakushie images to active CSAM distribution. However, the safety concern is widely recognized as a credible and serious risk for several reasons:

• Deliberate obfuscation tool — The entire purpose of kakushie is to make an image appear innocuous or unreadable in the timeline while hiding a second picture that requires a specific user action to reveal. This mechanism is directly exploitable for bypassing automated content moderation that scans only the public timeline thumbnail.
• Prior steganography precedent — In 2021, security researcher David Buchanan demonstrated that Twitter's PNG pipeline could be abused to hide ZIP archives, MP3 files, and up to 3 MB of arbitrary data inside posted images — a technique that could be used to distribute malware or illicit content under the radar of moderation scanners.
• X's known CSAM moderation failures — The Australian online safety regulator found CSAM to be "particularly systemic" on X, making it the worst platform for child abuse material. The nonprofit Alliance4Europe identified at least 150 accounts sharing CSAM over just four days in 2025. The European Commission opened an investigation into X for CSAM distribution in 2025. In June 2025, the child safety nonprofit Thorn terminated its partnership with X over unpaid invoices and the platform's failure to act on CSAM. The National Center on Sexual Exploitation described X as "the front page for sexual abuse online."
• Ofcom investigation — Ofcom opened a formal investigation into X on January 12, 2026, under the UK's Online Safety Act 2023, following the Grok AI scandal that generated sexualized images of real women and children. In June 2026, Ofcom ordered all social media platforms including X to adopt "critical incident" protocols to stop viral illegal content.
• Academic research — A 2025 academic paper ("Just in Plain Sight") examined how CSAM distribution campaigns operate openly on X using sockpuppet accounts and compromised profiles, confirming that the platform's moderation gaps are actively exploited.

Key caveat: While there is clear documented evidence of X's systemic CSAM problem and growing regulatory pressure, no specific report or investigation has yet confirmed kakushie images being actively used for CSAM. The concern remains a credible, widely discussed risk rather than a confirmed exploitation vector — but given that the entire technique is designed to hide images from public view, the potential for abuse is obvious and has been flagged by safety researchers.

The Regulatory Landscape

X is currently under scrutiny from multiple fronts, and the kakushie trend adds a new dimension to these existing concerns. It provides a technically trivial, widely accessible method for any user to post content that is invisible to automated moderation in the timeline and only visible after deliberate user interaction.

Until X adjusts its rendering pipeline to apply consistent content moderation scanning at both the thumbnail and full-resolution stages, the platform remains exposed to this exploitation vector.