Identity
Microsoft's X account hijacked to push a Clippy crypto token
Attackers held the 13 million follower @Microsoft account for about 30 minutes to promote a $Clippy token. What happened, and how to lock down company social accounts.
Attackers took over Microsoft's official X account, @Microsoft, which has more than 13 million followers, and used it to promote a crypto token themed on Clippy, the paperclip assistant from older versions of Office. The account followed and reposted an impersonator, swapped its profile picture for Clippy and posted a fake disclaimer before Microsoft got it back. Crowdfund Insider puts the attacker's control at roughly half an hour. Most reports, including BleepingComputer, SecurityWeek and IT-Connect, place it on Thursday, October 1, 2026; Crowdfund Insider dates it October 2.
Microsoft has confirmed unauthorised access but has not said how the attackers got in. That leaves every company with a branded social account asking the same question: if ours were taken tomorrow, which way in would they use, and how fast could we take it back?
What happened on the account
The first visible action was @Microsoft following and reposting a post from @clippymsftcto, an account posing as Clippy. X has since suspended it. The hijacked profile's picture was changed to Clippy at the same time, which made the theme look like an official marketing stunt to anyone scrolling past.
A second account, @ClippyMSFT, did the selling. It reposted Microsoft's post and promoted a token called $Clippy, claiming it "has a liquidity pool paired directly with $MSFT", the ticker for Microsoft's stock. A liquidity pool is the pot of two assets on a decentralised exchange that buyers trade against; pairing a token with something trusted is meant to suggest it has real backing. None of the reporting found any real link between the token and Microsoft. Crowdfund Insider describes the pairing as a promoter's claim, not a verified arrangement. BleepingComputer reported @ClippyMSFT was still promoting the token after the impersonator was suspended.
Then a post appeared on the hijacked account saying Microsoft had not authorised, sponsored or endorsed the creation of any Clippy token. It was deleted soon after. Microsoft later told BleepingComputer and SecurityWeek that this post, like the Clippy repost, did not come from the company. IT-Connect suggests it may have been meant to make followers think Microsoft was already back in control, buying the attackers time. That is speculation, but it shows that a statement posted on a compromised account cannot be trusted, even when it says the right thing.
A Microsoft spokesperson said: "We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft. The account has been secured and the unauthorized posts have been removed." The company says it is still investigating.
Why a big account is worth hijacking
Reports describe the scheme as a pump-and-dump. The promoters create or buy into a thinly traded token cheaply, push it through an account that millions of people trust, and sell their holdings into the rush of buyers. The price collapses once they stop, and the late buyers carry the loss. Half an hour on a 13 million follower account is enough for that. Government accounts are targets too: both BleepingComputer and SecurityWeek recall the US Securities and Exchange Commission's @SECGov account, taken over with a SIM swap in 2024.
How company social accounts get taken over
Microsoft has not disclosed the method. The routes below are general patterns behind corporate social-account takeovers, not a description of this case; SecurityWeek lists several of them as possibilities without confirming any.
Session or token theft is the quietest. Infostealer malware on the laptop of whoever runs the account copies the browser's session cookies, and the attacker loads them to arrive already logged in, so the password and two-factor authentication (2FA) never come into it.
In a SIM swap, the attacker talks a mobile carrier's support desk into moving the account's phone number to their SIM, then uses SMS codes or the phone-based password reset. Taking over the recovery email inbox works the same way.
Scheduling and analytics tools hold OAuth grants (delegated permission that works without the password) to post as the account. If the vendor, or your company's login to the tool, is compromised, so is the account.
Shared passwords and delegated team access widen the target. One login passed around a social team and an agency can be phished from whoever is least careful, and nobody can tell afterwards who signed in. Former staff and old agencies often keep access through posting tools long after the work ends.
What to do for your own accounts
On X, add a passkey under Settings and privacy, then Security and account access, then Security, and register a hardware security key as the 2FA method. X offers text message, authentication app and security key 2FA, and only Premium subscribers can use SMS codes; whatever the plan, take SMS off brand accounts and remove the phone number if nobody needs it. A passkey or security key will not sign in to a lookalike page. Keep the backup codes in your password manager.
Give each brand account a recovery email on a separate mailbox used for nothing else, itself behind a security key. A shared marketing inbox as the recovery address lets anyone who phishes it reset the account.
Audit connected apps. X lists them under Settings and privacy, then Security and account access, then Apps and sessions. Revoke any app nobody can name an owner for, and do it monthly. The same page lists active sessions: log out the ones you do not recognise, or use "Log out all other sessions" after any staff change. Treat an infostealer infection on a social manager's device as an account incident: log out every session and rotate the password from a clean machine.
Move any shared login into a password manager vault with named access, so you can see who has it and remove people individually. Every quarter, review who can post on each platform and through which login or tool. Put social accounts on the leaver checklist so access goes the day someone leaves or an agency contract ends.
Write a takedown runbook now. It should hold the platform's business or enterprise support contact (from your ad account manager or partner programme, if you have one), the order to reclaim the account, log out sessions and revoke apps, and who signs off on public statements. Agree that statement in advance and publish it on your website and other channels; a post from the compromised account proves nothing, as the fake Microsoft disclaimer shows.
Finally, watch for brand abuse in crypto. Monitor for new tokens, handles and domains using your company, product or mascot names, and report them early. The @ClippyMSFT account carried on selling after the takeover ended.
The wider lesson
Social accounts usually sit with marketing, outside the identity controls IT applies to email and cloud consoles. They deserve the same treatment as any privileged account: phishing-resistant sign-in, named access, reviewed grants and a rehearsed response.
Our safeguarding and hardening work covers sign-in, recovery and third-party access for accounts like these, and security operations can watch for brand abuse and help run the first hour of a takeover. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: BleepingComputer, SecurityWeek, Crowdfund Insider, IT-Connect, X Help Center: two-factor authentication, X Help Center: passkeys, X Help Center: third-party apps and sessions.