Microsoft X account hijacked to promote fraudulent Clippy cryptocurrency token

Microsoft's official X account, boasting over 13 million followers, was hijacked for approximately 30 minutes on October 2, 2026, to promote a fraudulent cryptocurrency token named $Clippy. Attackers changed the profile picture to the nostalgic paperclip assistant and posted viral bait promising its return for 500,000 likes. Microsoft spokesperson Brent Colburn confirmed the breach, stating the account was secured and an investigation is ongoing. Microsoft briefly posted and then deleted an apology threatening legal action and denying any connection between the token and its MSFT stock.

The hijacking of Microsoft's X account

• ▪During the October 2, 2026 hijack, attackers changed the Microsoft X account's profile picture to Clippy, followed an impersonator account, and reposted a promotional message.
• ▪Microsoft spokesperson Brent Colburn confirmed unauthorized access to the X account, stating that the account was secured, unauthorized posts were removed, and an investigation was underway.
• ▪The promotional campaign for the $Clippy token included a viral bait post promising that Microsoft would bring Clippy back if the post accumulated 500,000 likes.
• ▪Microsoft's official X account, with over 13 million followers, was hijacked for 30 minutes on October 2, 2026, to promote a fraudulent cryptocurrency token called $Clippy, themed after Microsoft's nostalgic paperclip virtual assistant.

Associated promotional accounts

• ▪The fraudulent impersonator account @clippymsftcto, which was followed and reposted by the hijacked Microsoft account, was subsequently suspended by X.
• ▪A second account, @ClippyMSFT, continued to promote the $CLIPPY token and claim its liquidity pools were paired with an MSFT token after @clippymsftcto was suspended.

Dispute over Microsoft stock backing

• ▪Promoters of the $CLIPPY token claimed that associated liquidity pools held over $200,000 and alleged that actual Microsoft shares backed the pools.
• ▪Microsoft explicitly denied any connection between the Clippy token and its actual stock ticker MSFT, stating that token ownership does not confer shares or rights in Microsoft Corporation.

Microsoft's deleted response to the hijack

• ▪Shortly after regaining control of its X account, Microsoft posted an apology disavowing the Clippy token and threatening legal action against the promoters, but subsequently deleted the post.
• ▪In the deleted post, Microsoft stated it had not authorized, sponsored, or endorsed any cryptocurrency token associated with Clippy, Microsoft, or the MSFT ticker.

Other cryptocurrency-related X account hacks

• ▪In June 2024, Microsoft's India X account was hijacked to promote a fake GameStop cryptocurrency pre-sale impersonating Keith Gill.
• ▪Other high-profile X account breaches in July 2026 targeted Robinhood CEO Vlad Tenev, Airbnb CEO Brian Chesky, and accounts associated with SpaceX and Starlink to promote fake tokens.

Debatable claims

• ▪X bears primary responsibility for securing high-profile corporate accounts against hijacking
• ▪Mainstream social media platforms are too insecure to host official corporate communications
• ▪Microsoft should pursue legal action against the promoters of the unauthorized Clippy token
• ▪Investors bear sole responsibility for financial losses incurred from social media cryptocurrency scams