Microsoft confirms unauthorized access to official X account in apparent Clippy token promotion
The account amplified posts about the $Clippy cryptocurrency before Microsoft removed the content and secured the account.
AIByer Newsroom
Reporting • Verification • Editorial review
AIByer Visual Desk
AIByer editorial illustration
Microsoft said its official @Microsoft X account experienced unauthorized access on October 1, 2026. The account followed and reposted content from a Clippy-impersonating account promoting the $Clippy token. Microsoft said it removed unauthorized posts, secured the account and was investigating.
Microsoft’s official X account was accessed without authorization on October 1, 2026, and used to promote or amplify a Clippy-themed cryptocurrency project.
The account, which had more than 13 million followers, followed and reposted content from an account impersonating Clippy, Microsoft’s former Office assistant. That associated account was later suspended. The promotion involved a token identified as $Clippy.
Microsoft denied authorizing or endorsing the token. The company said it removed unauthorized posts, secured the account and would pursue legal action.
Microsoft’s confirmation was given to The Verge and reproduced by BleepingComputer and other outlets. No standalone Microsoft incident notice was located.
The access method and attacker’s identity remain unknown. There is also no confirmed information about proceeds, investor losses or any impact on Microsoft’s internal, cloud or customer systems.
An associated account claimed the token was paired with MSFT stock, but that claim has not been established. The available evidence also does not confirm that the incident resulted in a completed pump-and-dump scheme.
Analysis
Why it matters
A compromise of a high-profile corporate social-media account can be used to give apparent legitimacy to unauthorized financial promotions. In this case, the scope of the access and any financial impact remain unknown.
Practical guidance
What to know
Treat unexpected cryptocurrency promotions from corporate accounts as potentially unauthorized until independently confirmed.
Do not assume that a token promoted by a verified or high-follower account is endorsed by the organization.
Monitor official account activity and remove unauthorized posts promptly if access is lost.
Transparency