Microsoft’s X Account Hijacked to Promote Clippy Meme Coin

On Thursday, Microsoft’s official X account began making surprising moves, including following an account promoting an unofficial meme coin inspired by the MSFT stock ticker and Clippy—Microsoft’s paperclip assistant that bounced around early editions of Office. It then reposted one of the account’s tweets, and changed its own profile picture to Clippy.

The posts were removed and an apology tweet appeared roughly 30 minutes later—and that was deleted almost as quickly, though people were able to grab a screenshot of it. Microsoft confirmed the breach subsequently to The Verge, saying:

We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft. The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.

It’s unclear why Microsoft deleted its lengthy apology tweet, but it covered a few key points:

• Microsoft said it never authorized anyone to promote a token using its intellectual property, including Clippy.
• It plans to pursue legal action to have the token and associated marketing removed.
• Its real MSFT ticker has nothing to do with any token carrying a similar name, which gives holders no ownership rights in Microsoft Corporation.

The token in question trades as CLIPPY, and an X account called Clippy MSFT has been one of its louder promoters, talking up liquidity pools reportedly worth over $200,000. Some promoters also claimed the pools were backed by actual Microsoft shares. That assertion, however, has not been verified—and even if true, there’s no official Microsoft link.

A Bigger Target in a Familiar Playbook

This is not the first time crypto scammers have used a Microsoft account. In 2024, attackers hijacked Microsoft India’s X account, which had more than 211,000 followers, to impersonate viral GameStop trader Keith “Roaring Kitty” Gill and push a fake Gamestop token presale built to drain wallets.

The hijack fits a pattern that has been climbing the ladder all year. In July, attackers took over Robinhood CEO Vlad Tenev’s X account to promote a fake token called Vladhood, falsely billed as the official Robinhood Chain mascot.

Ten days before that, an apparently hacked account linked to Elon Musk’s SpaceX promoted a meme coin that was then shared by Starlink’s also-compromised X account. That token reached a $2 million market cap before crashing to zero.