Microsoft X Account Hijacked to Promote Fraudulent Crypto Token
On Thursday, unknown attackers gained unauthorized access to Microsoft’s official X account (@Microsoft), which has over 13 million followers, and used it to promote a cryptocurrency token named $Clippy in what appeared to be a pump-and-dump scheme. The compromise began when the account followed and reposted a tweet from a now-suspended impersonation account (@clippymsftcto) that falsely claimed to represent Microsoft’s Clippy virtual assistant.
The attackers’ activity included amplifying a tweet that asserted the $Clippy token had "a liquidity pool paired directly with $MSFT," attempting to falsely link the token to Microsoft’s stock. Another tweet, which Microsoft confirmed it did not post, was later deleted and stated: "Microsoft doesn't support any cryptocurrency or crypto-related tokens." This message was part of the attackers’ attempt to mislead users about the company’s stance on digital assets.
Microsoft Responds and Secures Compromised Account
Microsoft confirmed the breach in a statement to BleepingComputer, acknowledging that unauthorized posts had been made from its account. "We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft," a spokesperson said. "The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances."
The company also clarified that it has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT. This statement was reiterated in a deleted tweet that Microsoft said it did not publish.
Recurring Pattern of X Account Hijacks Targeting Major Brands
This incident is not isolated. In June 2024, Microsoft’s India X account (@MicrosoftIndia), with over 211,000 followers, was similarly compromised by crypto scammers who impersonated Roaring Kitty, the online alias of meme stock trader Keith Gill. The hijacked account was used to promote a fraudulent presale website (presaIe-roaringkitty[.]com) that claimed to offer GameStop (GME) cryptocurrency tokens.
Visitors to the site were lured into connecting their cryptocurrency wallets, which triggered a wallet drainer malware that stole their digital assets. The attackers also used the compromised account to reply to tweets and direct users to the malicious domain, amplifying the reach of the scam.
Broader Trend of Crypto Scams via Social Media Account Takeovers
The Microsoft hack fits into a larger pattern of cybercriminals hijacking verified social media accounts to promote cryptocurrency fraud. In December 2023, blockchain threat analysts at ScamSniffer reported that cybercriminals stole approximately $59 million in cryptocurrency from 63,000 individuals during a single Twitter ad campaign between March and November, leveraging the notorious "MS Drainer" wallet drainer malware.
Additionally, in 2024, the U.S. Securities and Exchange Commission’s official X account (@SECGov) was compromised via a SIM-swapping attack. The hacker, Eric Council Jr., posted a false announcement about the approval of Bitcoin exchange-traded funds (ETFs), causing a temporary spike in Bitcoin prices. He later pleaded guilty in February 2025 and was sentenced to 14 months in prison for his role in the conspiracy to manipulate Bitcoin’s value through the compromised account.
These incidents underscore the growing risk of account takeover attacks on verified organizational profiles, particularly when used to lend credibility to financial scams. Microsoft’s swift action to remove the unauthorized content and secure its account reflects standard incident response procedures, though the recurrence of such breaches highlights ongoing vulnerabilities in social media account security."
Source: BleepingComputer