Microsoft’s X account hijacked in Clippy crypto scheme

Microsoft’s official X account, which has more than 13 million followers, was hijacked on Oct. 1 and briefly used to promote a fake Clippy-themed cryptocurrency. The company later secured the account and removed the unauthorized posts.

The account briefly followed a profile posing as Clippy, reposted one of its messages and used an image of the animated paperclip as its profile picture. The profile promoting the token has since been suspended.

The token, promoted as $Clippy, was marketed as being linked to Microsoft’s $MSFT stock ticker through a liquidity pool. There is no evidence that Microsoft created, supported or authorized the token.

Microsoft spokesperson Brent Colburn confirmed that the account had been accessed without authorization. “We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft,” Colburn wrote in a statement. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”

A brief apology appeared on the account and was deleted about 30 minutes later. The post acknowledged that a token was being marketed in connection with Microsoft’s stock and was using the Clippy name without permission. It added that Microsoft did not “support, endorse, sponsor, or authorize any cryptocurrency or crypto-related token.”

Microsoft has not disclosed how the attackers gained access. The incident follows the January 2024 takeover of the U.S. Securities and Exchange Commission’s X account, which regulators attributed to a SIM-swap attack. Security researchers have linked account takeovers to SIM swaps and stolen login credentials rather than flaws in the social media platform.