News Date: 2026-10-02
Unknown attackers hijacked Microsoft's official account on X and used its reach to promote a cryptocurrency token associated with the company's Clippy character. The account, followed by more than 13 million users, reposted content from an account impersonating a Microsoft-linked cryptocurrency project before the unauthorized material was removed.
Microsoft confirmed that its account had been accessed without authorization, said the fraudulent posts had been deleted and stated that it was investigating the circumstances. The company also clarified that it had not created, sponsored or endorsed the promoted token.
Trust was the attackers' main asset
The incident is significant because the attackers did not need to compromise a Microsoft product or customer environment to create risk. Access to a highly trusted communications channel was enough to give a questionable financial promotion the appearance of legitimacy.
Corporate social accounts are frequently managed by multiple employees, agencies and publishing platforms. That can create a complicated chain of passwords, API tokens, active sessions and third-party permissions. At the time of publication, the precise route used to access Microsoft's account had not been disclosed, so it would be premature to blame a particular authentication or platform failure.
Controls for high-profile accounts
- Require phishing-resistant hardware security keys for every administrator.
- Eliminate shared credentials and assign access through named accounts.
- Review third-party publishing tools and revoke integrations that are no longer required.
- Require secondary approval for financial, security or product announcements.
- Monitor new sessions, permission changes and unusual posting behavior continuously.
- Maintain a response plan that includes rapid session revocation and public correction procedures.
Expert view
In my view, organizations should classify major social media accounts as production systems rather than marketing conveniences. A compromised brand account can support financial fraud, phishing, malware delivery or market manipulation while bypassing much of the skepticism users apply to unknown senders.
The defensive lesson is not simply to enable multifactor authentication. Companies also need strict administrative ownership, resilient recovery methods, independent monitoring and rehearsed crisis communications. The shorter the interval between the fraudulent post and an authoritative correction, the fewer opportunities attackers have to turn borrowed trust into money or stolen credentials.