Microsoft X account compromised to promote unauthorized Clippy cryptocurrency

Microsoft account posts unauthorized Clippy promotion

Microsoft's official X account was compromised and used to promote an unauthorized Clippy-themed cryptocurrency. The account, which has 13 million followers, started following a Clippy crypto account and reposted one of its tweets on Thursday. Microsoft's profile picture was also briefly changed to an image of Clippy, the animated paperclip assistant introduced with Office 97 and later removed because of its intrusive pop-ups.

About 30 minutes after the original posts were taken down, the account published an apology that was soon deleted. Microsoft confirmed that it had not published the tweets. A deleted and apparently fake post said a cryptocurrency token was being promoted in connection with $MSFT stock through unauthorized use of the Clippy brand and Microsoft-related intellectual property. It claimed that Microsoft had not authorized, sponsored, endorsed or permitted the token.

One fake account closes while another remains active

X shut down @clippymsftcto, which had been posing as Clippy. Another account, @ClippyMSFT, was still promoting a $Clippy token and claiming that it had a liquidity pool paired directly with $MSFT.

Microsoft later said the account had been secured and the unauthorized posts removed. Spokesperson Brent Colburn said Microsoft had confirmed unauthorized access to its X account, including posts that did not come from Microsoft. The company said it was continuing to investigate the circumstances.

Earlier Microsoft account impersonation

The incident was not the first time scammers had hijacked an official Microsoft account. In June 2024, attackers used Microsoft's India X account to impersonate meme-stock trader Roaring Kitty, whose name is Keith Gill, and promote a fake GameStop cryptocurrency presale intended to drain victims' wallets.