Attackers hijack Microsoft's 13-million-follower X account to promote a Clippy crypto token
Unknown attackers hijacked @Microsoft, the company's X account with more than 13 million followers, on Thursday to promote a $Clippy crypto token. Microsoft has not said how they got in, and the takeover fits a run of crypto-scam hijacks of verified accounts on X.
The Watch · Security desk
What happened
- The takeover started with @Microsoft following and reposting @clippymsftcto, a now-suspended account impersonating the Clippy assistant, as The Verge first reported.
- Microsoft says the account has been secured and the attackers' posts removed, and that it is still investigating the circumstances.
- A second account, @ClippyMSFT, still links to Microsoft's retweet and claims the $Clippy token has a liquidity pool paired directly with $MSFT.
- In a since-deleted post, Microsoft apologized for the posts and said it would take legal action over the token.
Why it matters
- What it limits constraint Until Microsoft says how the attackers got in, other companies running X accounts cannot check themselves against this specific failure; the only public entry point among the cited cases is the SEC's SIM swap.
- Who's exposed exposure Securing @Microsoft ended the attackers' access but left the endorsement in circulation, so anyone who reaches @ClippyMSFT can still be shown Microsoft's repost as backing for the token.
- What it sets up precedent The SEC hijack produced a guilty plea and a 14-month sentence, so using a seized verified account to move a price already has a prosecution on record.
Next story · Invest · Sep 20
Nscale assembles a 22-firm underwriting syndicate before setting a size for its NYSE offeringConfirmed4 publishers
The token pitch ran on Clippy impersonator accounts, and @Microsoft gave it reach with a follow and a repost [2][3]. BleepingComputer described the operation as what appeared to be a pump-and-dump [1]. Microsoft's since-deleted statement addressed the stock ticker the promoters used. "Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT," the company wrote [14].
The breach Microsoft has confirmed is one social account. "We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft," a Microsoft spokesperson told The Verge [4]. The company has not said how the attackers got in, and a spokesperson was not immediately available when BleepingComputer asked for more details [6].
BleepingComputer cites an earlier Microsoft case. In June 2024, crypto scammers took over @MicrosoftIndia, an account with more than 211,000 followers, and used it to impersonate Roaring Kitty, the handle of meme-stock trader Keith Gill [7]. They replied to tweets and steered people to presaIe-roaringkitty[.]com, a fake presale for GameStop crypto. Anyone who connected a wallet there and authorized transactions lost their crypto to a drainer [8].
@Microsoft has roughly 60 times that audience [12]. The 2024 crew emptied wallets directly. Thursday's attackers, on the reporting so far, promoted a token [1][8].
The SEC case is the one in this set with a known entry point. Its @SECGov account was taken over through SIM swapping and used to post a fake approval of Bitcoin exchange-traded funds. Bitcoin's price spiked, temporarily but significantly [10]. Eric Council Jr., the hacker behind that takeover, pleaded guilty in February 2025 and was sentenced to 14 months in prison for his role in a conspiracy to manipulate Bitcoin's value [11].
What to watch
- Whether Microsoft's investigation discloses how the attackers gained access to @Microsoft.
- Whether @ClippyMSFT is suspended, and whether Microsoft's promised legal action names the token's creators.
- Any trading data showing how much money went into $Clippy while Microsoft's repost was up.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence72
Perspective Coverage
7 publishers- Builder
- Builder 16%
- Operator
- Operator 46%
- Investor
- Investor 38%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On Thursday, unknown attackers hijacked the official Microsoft account on X (@Microsoft), which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token.
- [2]
The attack began when the @Microsoft account followed and reposted a tweet from a now-suspended X account (@clippymsftcto) impersonating Microsoft's Clippy virtual assistant; The Verge first reported this.
- [3]
Another X account, @ClippyMSFT, which linked to Microsoft's retweet, is still promoting a $Clippy crypto token, claiming it "has a liquidity pool paired directly with $MSFT."
- [4]
"We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft," a Microsoft spokesperson told The Verge.
- [5]
"The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances." (Microsoft spokesperson to The Verge)
- [6]
A Microsoft spokesperson was not immediately available to comment when BleepingComputer reached out for more details on the incident; Microsoft says it is investigating the circumstances.
- [7]
In June 2024, crypto scammers hijacked the Microsoft India account on X (@MicrosoftIndia), with over 211,000 followers, to impersonate Roaring Kitty, the handle of meme stock trader Keith Gill.
- [8]
The attackers used the hijacked Microsoft India account to reply to tweets and lure people to presaIe-roaringkitty[.]com, a site offering a GameStop (GME) crypto presale; anyone who connected a wallet and authorized transactions had crypto stolen by a wallet drainer.
- [9]
X users have been targeted by a massive wave of account hijacks in recent years, with verified organizations falling victim to hacks promoting cryptocurrency scams and wallet drainers.
- [10]
The U.S. SEC's @SECGov account was compromised in a SIM-swapping attack and used to post a fake announcement of Bitcoin ETF approval, which caused a temporary but significant spike in Bitcoin prices.
- [11]
Eric Council Jr., the hacker behind the @SECGov hijack, pleaded guilty in February 2025 and was sentenced to 14 months in prison for his role in a conspiracy that used the compromised account to manipulate Bitcoin's value.
- [12]
@Microsoft's follower count is roughly 60 times that of @MicrosoftIndia at the time of its 2024 hijack.
- [13]
In a now-deleted tweet, Microsoft apologized for the posts, said it does not support any cryptocurrency or crypto-related token, and said it will take legal action.
- [14]
"Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT," Microsoft said.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMicrosoft’s X account hacked in crypto pump-and-dump scheme
1 article · October 2, 2026
- crowdfundinsider.comMicrosoft’s Official X Account Briefly Hijacked to Push a Clippy Meme Coin
1 article · October 4, 2026
- crypto.newsHackers use Microsoft’s X account to push unofficial Clippy token
1 article · October 3, 2026
- cryptobriefing.comCrypto scammers hijack Microsoft’s official X account to push a fake Clippy token
1 article · October 2, 2026
- dev.toMarket Analysis: The Microsoft X Hijack and the Weaponization of Brand Authority in the Crypto Era
1 article · October 3, 2026
- scworld.comMicrosoft X account hijacked for crypto scam
2 articles · October 5, 2026
- securityweek.comCrypto Scammers Hijack Microsoft’s Official X Account
1 article · October 2, 2026
Topics and entities
Topics
- Social media account takeover
- Crypto pump-and-dump schemes
Entities
- Microsoft
- U.S. Securities and Exchange Commission
- Eric Council Jr.
- The Verge
- X