Crypto Scammers Hijack Microsoft’s Official X Account
Hackers hijacked Microsoft's official X account with 13M followers to promote fake Clippy-themed cryptocurrency token.
Microsoft's official X account was compromised and used to amplify a Clippy-themed cryptocurrency scam. The attackers changed the profile picture to Clippy, followed a crypto account (@clippymsftcto), and promoted a fake $Clippy token falsely claiming MSFT pairing. Microsoft secured the account within 30 minutes and posted (then deleted) a statement clarifying it does not support any cryptocurrency, while investigating the breach.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMicrosoft's official X (formerly Twitter) account was compromised by attackers who exploited weak or stolen credentials to promote a fraudulent cryptocurrency token, leveraging the brand's massive trust and visibility for financial fraud. The root cause likely involves insufficient multi-factor authentication enforcement, credential phishing, or session token theft targeting high-profile social media accounts. This incident highlights that even major technology companies can fall victim to account takeovers on third-party platforms where security controls may not meet enterprise standards. The fact that Microsoft contained the breach within 30 minutes demonstrates effective incident response, but the reputational and financial harm to followers who may have acted on the scam can still be significant.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.