InfoSecBulletin Cybersecurity for mankind
Microsoft’s official X account was taken over to promote an unapproved Clippy-themed cryptocurrency. The tech giant’s X account, with 13 million followers, began following a Clippy crypto account and shared one of its tweets on Thursday.
Clippy is an old animated paperclip helper from Microsoft. It came with Office 97 but was taken away because its pop-ups were annoying. Microsoft also changed its profile picture to show Clippy.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
About 30 minutes after the first posts were removed, the account shared a strange apology that was quickly deleted. Microsoft said they did not post any of those tweets.
“We are aware of a cryptocurrency token being promoted in connection with $MSFT stock, including the unauthorized use of the Clippy brand and Microsoft-related intellectual property. Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT,” the deleted and apparently fake tweet read.
X has since shut down the @clippymsftcto account posing as Clippy, but a second account (@ClippyMSFT) is still promoting a $Clippy token, claiming that it “has a liquidity pool paired directly with $MSFT.”
Microsoft later confirmed that its account had been compromised and said the unauthorized posts had been removed.
“We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft,” said Microsoft spokesperson Brent Colburn, according to The Verge. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”
Scammers have taken over a Microsoft account before. In June 2024, they used Microsoft’s India X account to pretend to be trader Roaring Kitty (Keith Gill) and promote a fake GameStop crypto presale to empty victims’ wallets.
