Overview
- Microsoft’s official X account, which has more than 13 million followers, was taken over on Thursday when attackers had it follow and repost a tweet from an impersonator account using the Clippy persona.
- Attackers changed the profile image to Clippy and promoted a $Clippy token while one impersonator account was suspended and another promotional account continued to push claims about a liquidity pool tied to Microsoft stock.
- Microsoft says the account has been secured, the unauthorized posts were removed, and an apology post that promised legal steps was briefly published and then deleted as the company continues its investigation.
- Microsoft has not disclosed how the attackers gained access, and reporting lists several plausible routes including SIM swapping, stolen email or session cookies, infostealer malware on an employee device, or abuse of third‑party social tools.
- The takeover fits a recurring pattern of verified account hijacks used to amplify crypto scams, a trend that raises risks for individual investors and increases pressure on companies and platforms to harden controls and speed incident response.