Hackers Hijack X Account of Microsoft to Push Fake Crypto Coin

Microsoft’s official account on X was briefly taken over on Oct. 1, with hackers using the company’s large following to promote a crypto scam based on Clippy, the familiar animated paperclip once included with Microsoft Office.

Microsoft confirmed the incident, noting that the account had been recovered and unauthorized material deleted. The breach affected @Microsoft, a profile followed by over 13 million users, giving the fraudulent campaign access to a significant audience before it was stopped.

During the attack, the account followed @clippymsftcto, re-shared a post, and replaced its profile image with a picture of Clippy. The attackers pushed a token dubbed $Clippy and claimed the company would revive the retired digital assistant if a related post collected half a million likes.

The hackers also attempted to create the impression of a connection with Microsoft’s publicly traded shares using the ticker-style label “MSTF.” There was no legitimate evidence supporting such an association. X later banned the account behind the promotion.

After the promotional messages, another message was posted on the Microsoft profile that seemed to distance the company from the crypto scheme, apologize to followers, and threaten legal recourse against the scammers. However, BleepingComputer reported that Microsoft didn’t publish the message, raising further uncertainty over which communications were genuine.

Reports have differed over the status of that statement. Some said Microsoft had rejected the token and denied any association with its shares, while others described the supposed corporate response as fraudulent. Microsoft hasn’t publicly provided a detailed account identifying which posts were made by the company and which were uploaded by the attackers.

The episode is not the first time Microsoft has faced a crypto-related takeover on X. In June 2024, hackers compromised the company’s India-focused account and promoted a supposed GameStop token presale associated with investor Keith Gill (Roaring Kitty). The scheme directed X users to a site that was reported as capable of compromising crypto wallets.

The recent incident lasted about half an hour before Microsoft regained control. The company has not explained how the attackers obtained access or said whether additional security measures have been introduced.

The breach illustrates the risks faced by prominent social media pages, where a trusted corporate identity can give fraudulent investment schemes an immediate appearance of legitimacy. For users and investors, the incident is another reminder to verify crypto promotions through independent official channels rather than relying solely on posts from a compromised corporate account.

This incident is likely to prompt businesses like Marathon Digital Holdings Inc. (NASDAQ: MARA) in the crypto industry to tighten the cybersecurity of their social media accounts in order to limit the likelihood of being targeted in the same way that Microsoft was targeted.

About CryptoCurrencyWire

CryptoCurrencyWire (“CCW”) is a specialized communications platform with a focus on blockchain and the cryptocurrency sector. It is one of 75+ brands within the Dynamic Brand Portfolio @ IBN that delivers: (1) access to a vast network of wire solutions via InvestorWire to efficiently and effectively reach a myriad of target markets, demographics and diverse industries; (2) article and editorial syndication to 5,000+ outlets; (3) enhanced press release enhancement to ensure maximum impact; (4) social media distribution via IBN to millions of social media followers; and (5) a full array of tailored corporate communications solutions. With broad reach and a seasoned team of contributing journalists and writers, CCW is uniquely positioned to best serve private and public companies that want to reach a wide audience of investors, influencers, consumers, journalists and the general public. By cutting through the overload of information in today’s market, CCW brings its clients unparalleled recognition and brand awareness. CCW is where breaking news, insightful content and actionable information converge.

To receive SMS alerts from CryptoCurrencyWire, text “CRYPTO” to 888-902-4192 (U.S. Mobile Phones Only)

For more information, please visit https://www.CryptoCurrencyWire.com

Please see full terms of use and disclaimers on the CryptoCurrencyWire website applicable to all content provided by CCW, wherever published or re-published: https://www.CryptoCurrencyWire.com/Disclaimer

CryptoCurrencyWire
Austin, Texas
www.CryptoCurrencyWire.com
512.354.7000 Office
Editor@CryptoCurrencyWire.com

CryptoCurrencyWire is powered by IBN