Microsoft @Microsoft X account hijacked (1 Oct): Clippy crypto pump-and-dump; account secured
The Verge (1 October 2026; Tom Warren) and BleepingComputer (2 Oct) report that unknown attackers hijacked the official Microsoft account on X (@Microsoft; ~13M followers) in a crypto pump-and-dump promoting a $Clippy token. The compromise began when @Microsoft followed and reposted a now-suspended impersonation account (@clippymsftcto) posing as Clippy; a related @ClippyMSFT account continued promoting the token with claims of a liquidity pool paired with $MSFT.
Microsoft spokesperson Brent Colburn confirmed unauthorised access and posts that did not come from Microsoft; the account was secured, unauthorised posts removed, and investigation continues.
Microsoft also stated it does not authorise or endorse any Clippy/$MSFT-linked cryptocurrency and will pursue legal action to remove the token materials. Distinct from the June 2024 @MicrosoftIndia crypto-drainer hijack. No product CVE. Primary: The Verge 1 Oct; wire: BleepingComputer 2 Oct.
- Product
- Microsoft brand account on X (@Microsoft); Clippy IP abuse (not a Microsoft product CVE)
- Versions
- n/a (social-account compromise). Related handles noted in wires: @clippymsftcto (suspended), @ClippyMSFT (token promo).
- Exploited in Australia?
- unknown
- Patch to
- Treat unsolicited Clippy/$MSFT crypto tokens and related X posts as scams. Prefer official Microsoft channels for product/security notices. Orgs: review brand-account MFA / role access on X; revoke sessions after any suspected takeover.