Microsoft’s X account hacked to promote fake Clippy token

Microsoft’s official X account was hacked on Thursday and used to promote a fake cryptocurrency token based on Clippy, the company’s retired Office assistant. The account has more than 13 million followers.

Attackers made the compromised account follow and repost content from an impersonator account posing as Clippy, boosting its reach among millions of followers. X has since suspended that impersonator account.

Microsoft has confirmed the breach. “We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft,” spokesperson Brent Colburn said in a statement. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”

Several posts appeared from the compromised account during the incident. One, which Microsoft says it did not publish, distanced the company from the token and stated it had never authorised any cryptocurrency tied to Clippy or its brand. An apology styled message also surfaced around 30 minutes after the hijack posts were removed, before being deleted shortly after.

The hijack mirrors a June 2024 attack on the Microsoft India X account. Scammers took over @MicrosoftIndia, which had more than 211,000 followers, and used it to impersonate Roaring Kitty, the handle of meme stock trader Keith Gill. Followers were directed to a fake GameStop crypto presale site fitted with wallet drainer malware, which stole assets from anyone who connected a cryptocurrency wallet and authorised transactions.

Verified accounts have become prime targets for crypto fraud. Blockchain threat analysts at ScamSniffer reported in December 2023 that criminals stole roughly $59 million from 63,000 people through wallet drainer ads on Twitter between March and November 2023 alone.

High profile account takeovers have also moved markets. In January 2024, the US Securities and Exchange Commission’s @SECGov account was compromised through a SIM swapping attack. The hackers posted a fake announcement about Bitcoin exchange traded fund approvals, causing a brief spike in Bitcoin prices. Eric Council Jr, the man behind the hijack, pleaded guilty in February 2025 and was sentenced to 14 months in prison.

The method used to breach the Microsoft account has not been disclosed. Common techniques include SIM swapping, compromised recovery email addresses, stolen session cookies and phishing. Security researchers advise organisations managing large social media accounts to use hardware security keys, restrict posting rights to a small group and monitor for unauthorised changes.

The timing is awkward for Microsoft. Last month the company led an industry takedown of EvilTokens, an AI powered phishing platform linked to more than 12,000 compromised Microsoft 365 accounts across 10,000 organisations. Microsoft secured a US court order to seize 50 websites and disable more than 175 domains tied to the service.

Microsoft has not said whether it will pursue legal action over the unauthorised use of its brands and intellectual property.