InfoSecBulletin Cybersecurity for mankind
Microsoft’s official X account was taken over to promote an unapproved Clippy-themed cryptocurrency. The tech giant’s X account, with 13 million followers, began following a Clippy crypto account and shared one of its tweets on Thursday.
Clippy is an old animated paperclip helper from Microsoft. It came with Office 97 but was taken away because its pop-ups were annoying. Microsoft also changed its profile picture to show Clippy.
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
About 30 minutes after the first posts were removed, the account shared a strange apology that was quickly deleted. Microsoft said they did not post any of those tweets.
“We are aware of a cryptocurrency token being promoted in connection with $MSFT stock, including the unauthorized use of the Clippy brand and Microsoft-related intellectual property. Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT,” the deleted and apparently fake tweet read.
X has since shut down the @clippymsftcto account posing as Clippy, but a second account (@ClippyMSFT) is still promoting a $Clippy token, claiming that it “has a liquidity pool paired directly with $MSFT.”
Microsoft later confirmed that its account had been compromised and said the unauthorized posts had been removed.
“We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft,” said Microsoft spokesperson Brent Colburn, according to The Verge. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”
Scammers have taken over a Microsoft account before. In June 2024, they used Microsoft’s India X account to pretend to be trader Roaring Kitty (Keith Gill) and promote a fake GameStop crypto presale to empty victims’ wallets.
