Microsoft's X Account Hijacked in Crypto Scam
Attackers hijacked Microsoft's official X account — more than 13 million followers — and used it to promote a cryptocurrency token in what appeared to be a pump-and-dump scheme, Microsoft has confirmed.
Key facts
What happened: The @Microsoft account followed and reposted content from an account impersonating Microsoft's Clippy assistant, promoting a $Clippy crypto token
When: Thursday, October 1, 2026
The claim used: The promoting account said the token had a liquidity pool paired directly with $MSFT
Microsoft's position: It has not authorized, sponsored or endorsed any cryptocurrency token associated with Clippy, Microsoft or $MSFT
Status: Posts removed, account secured, investigation ongoing
Not the first: Microsoft India's X account was hijacked in a crypto scam in June 2024
What is a pump-and-dump?
A scheme where promoters drive up the price of an asset with hype, then sell their holdings into the demand they created, leaving later buyers holding something worth far less.
A hijacked account with 13 million followers is close to ideal for this. The credibility is borrowed, the reach is instant, and the window before the account is recovered is enough.
What did Microsoft say?
A spokesperson confirmed unauthorized access to the account, including posts that did not come from Microsoft, and said the account has been secured, the unauthorized posts removed, and the circumstances are under investigation.
Microsoft also stated it has not authorized, sponsored, endorsed or granted permission for the creation, promotion or use of any cryptocurrency token associated with Clippy, Microsoft or $MSFT, and that it does not support any cryptocurrency or crypto-related tokens.
How common is this?
Common enough to be a category. High-profile X account hijacks promoting crypto scams have hit major organizations repeatedly.
In June 2024, attackers hijacked Microsoft India's account — 211,000 followers — to impersonate meme-stock trader Roaring Kitty and direct followers to a site claiming to sell GameStop crypto in a presale. Anyone who connected a cryptocurrency wallet and authorized transactions had their assets stolen by a wallet drainer.
In 2024 the U.S. Securities and Exchange Commission's @SECGov account was compromised in a SIM-swapping attack and used to post a fake announcement approving Bitcoin exchange-traded funds, briefly spiking Bitcoin's price. The hacker responsible pleaded guilty and was sentenced to 14 months in prison.
Blockchain analysts at ScamSniffer found that criminals stole roughly $59 million from 63,000 people through a single wave of malicious X advertising between March and November 2023.
How to protect yourself
The principle: a verified account is not a verified claim. Verification confirms who registered an account, not who is currently controlling it or whether what it says is true.
Practical rules for crypto promotion from any account, however official:
Never connect your cryptocurrency wallet to a site you reached through a social media link. Wallet drainers work by getting you to authorize a transaction that empties your holdings — the authorization is the attack.
Check the company's own website or newsroom before acting on a financial announcement from its social account.
Treat urgency as the warning sign. Pump-and-dump schemes need you to buy before you think, because the scheme stops working once enough people check.
Established companies do not launch cryptocurrency tokens through surprise social media posts.
Sources: BleepingComputer; The Verge.