Microsoft confirmed on October 1, 2026, that its official X account, which has more than 13 million followers, was compromised by unknown attackers who used it to promote a cryptocurrency token, according to The Verge and BleepingComputer.
What Happened
The @Microsoft account followed and reposted a tweet from @clippymsftcto, an account impersonating the company’s retired Clippy virtual assistant, and briefly swapped its profile picture to a Clippy image. The posts promoted a token called $Clippy, with a related account claiming its liquidity pool was “paired directly with $MSFT.” A message offering to “bring Clippy back” if the post reached 500,000 likes followed before the posts were removed. Roughly 30 minutes later, an unauthorized “apology” post appeared and was deleted shortly after.
Response and Prior Incidents
“We have confirmed unauthorized access to our account on X, including posts that did not originate from Microsoft,” Microsoft spokesperson Brent Colburn said, according to The Verge and PCMag. “The account has been secured, the unauthorized posts have been removed, and we are continuing to investigate the circumstances.” The impersonating @clippymsftcto account has since been suspended, though a separate account continued promoting the token afterward. Microsoft has not disclosed how the attackers gained access. BleepingComputer noted that Microsoft’s X accounts have been targeted before: the @MicrosoftIndia account was hijacked in 2024 to push a wallet-drainer crypto scam.
The incident underscores the continued appeal of large corporate social accounts as vectors for cryptocurrency fraud, independent of the underlying platform’s own account-security controls. More account takeover and social-engineering developments are tracked in the SectechMedia Technology News archive.