Microsoft’s X Account Hijacked for a Clippy Crypto Pump-and-Dump

On Thursday, unknown attackers seized control of Microsoft’s official account on X, a profile with more than 13 million followers. The incident looked like a textbook pump-and-dump: artificially inflating interest in a crypto token before dumping it.

According to The Verge, which first reported the breach, the attack began when @Microsoft followed and reposted another account. That profile, @clippymsftcto, impersonated Microsoft’s virtual assistant — the famous Clippy paperclip — and was later suspended. A second account, @ClippyMSFT, survived and kept pushing a $Clippy token, claiming it had "a liquidity pool paired directly with $MSFT."

Microsoft responds

The company removed the attackers’ posts and confirmed the compromise. "We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft," a spokesperson said. "The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances."

In a now-deleted tweet, Microsoft apologized for the posts and stressed that it does not support any cryptocurrency or crypto-related token. The company explicitly disavowed the token, its creators, and any related crypto project, and warned it would pursue legal action over the unauthorized use of the Clippy brand and other Microsoft intellectual property.

Not the first time

This is not the first time an official Microsoft account on X has been hijacked. In June 2024, scammers took over the Microsoft India profile (over 211,000 followers) and dressed it up as meme-stock trader Keith Gill, known as Roaring Kitty. Victims were lured to a malicious site posing as a GameStop crypto presale, where connecting a wallet got it drained.

In recent years X users have faced a sustained wave of account takeovers and malicious ads, with even verified organizations turned into vehicles for crypto scams. Analysts at ScamSniffer estimated that a single ad campaign running the "MS Drainer" wallet drainer between March and November 2023 stole roughly $59 million from 63,000 people.

Last year the U.S. Securities and Exchange Commission’s @SECGov account was compromised via a SIM-swapping attack and used to post a false claim that Bitcoin ETFs had been approved, briefly spiking the price. Eric Council Jr., the hacker behind that breach, pleaded guilty in February 2025 and was sentenced to 14 months in prison.

Source: Bleeping Computer