InfoSecBulletin Cybersecurity for mankind
Microsoft’s official X account was taken over to promote an unapproved Clippy-themed cryptocurrency. The tech giant’s X account, with 13 million followers, began following a Clippy crypto account and shared one of its tweets on Thursday.
Clippy is an old animated paperclip helper from Microsoft. It came with Office 97 but was taken away because its pop-ups were annoying. Microsoft also changed its profile picture to show Clippy.
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
About 30 minutes after the first posts were removed, the account shared a strange apology that was quickly deleted. Microsoft said they did not post any of those tweets.
“We are aware of a cryptocurrency token being promoted in connection with $MSFT stock, including the unauthorized use of the Clippy brand and Microsoft-related intellectual property. Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT,” the deleted and apparently fake tweet read.
X has since shut down the @clippymsftcto account posing as Clippy, but a second account (@ClippyMSFT) is still promoting a $Clippy token, claiming that it “has a liquidity pool paired directly with $MSFT.”
Microsoft later confirmed that its account had been compromised and said the unauthorized posts had been removed.
“We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft,” said Microsoft spokesperson Brent Colburn, according to The Verge. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”
Scammers have taken over a Microsoft account before. In June 2024, they used Microsoft’s India X account to pretend to be trader Roaring Kitty (Keith Gill) and promote a fake GameStop crypto presale to empty victims’ wallets.
