By Hamza Faisal
Microsoft's official X account, one of the most-followed corporate handles on the platform with more than 13 million followers, was hijacked on October 1 and briefly turned into a vehicle for a cryptocurrency pump-and-dump scheme. Attackers used the account to promote a fake Clippy-themed token, swapping the company's profile picture for an image of the retired Office assistant before Microsoft regained control and secured the account.
The takeover began on the afternoon of October 1, when the @Microsoft handle started following and reposting content from @clippymsftcto, an account posing as the beloved — and long-retired — Clippy paperclip. The fake account was pushing a token called $Clippy, while a second account, @ClippyMSFT, told followers the token had "a liquidity pool paired directly with $MSFT."

A 30-minute takeover, and a fake apology

Microsoft removed the unauthorized posts within about half an hour, but the episode did not end there. Roughly 30 minutes after the original posts were taken down, a bizarre "apology" appeared on the account — and was quickly deleted as well. Microsoft later confirmed it had published none of the messages.
"We are aware of a cryptocurrency token being promoted in connection with $MSFT stock, including the unauthorized use of the Clippy brand and Microsoft-related intellectual property," the deleted post read. "Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT."
X has since suspended the @clippymsftcto account, though @ClippyMSFT was still promoting the $Clippy token at the time of reporting. Microsoft has not said how the attackers gained access to the account, and says it is continuing to investigate.

What Microsoft said

"We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft," Microsoft spokesperson Brent Colburn told The Verge. "The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances."
The company also clarified that the short-lived apology post was itself part of the unauthorized activity. A now-deleted tweet added that Microsoft would "pursue appropriate legal action" to have the unauthorized token and related materials removed. The token's promoters had claimed a liquidity pool valued at more than $200,000 and implied the token was effectively backed by Microsoft stock — claims that were never true.

Not the first time

This is not the first time a Microsoft handle on X has been compromised. In June 2024, crypto scammers hijacked the @MicrosoftIndia account, which had more than 211,000 followers, to impersonate Roaring Kitty, the handle of meme-stock trader Keith Gill.
Security researchers have long warned that verified corporate accounts are prime targets for this kind of fraud: attackers don't need to build credibility when they can borrow it. Thirty minutes inside one of the most-followed accounts on the platform was enough to broadcast a scam to millions of people — a reminder that even a blue checkmark is no guarantee the person posting is who you think it is.
By Hamza Faisal