Full Breakdown
Microsoft’s Verified X Account Hijacked for a Crypto Pump-and-Dump Scheme
By Drooid · · How we work
Incident Overview
Attackers gained unauthorized access to Microsoft’s official X account, which has more than 13 million followers, and used it to repost content promoting a cryptocurrency dubbed “$Clippy.” Two posts appeared during the breach: a quote referencing the nostalgic Office paper-clip character and a subsequent apology. Microsoft confirmed the posts did not originate from the company, removed them, and secured the account.
Prior Verified Account Takeovers
The Microsoft breach follows similar incidents involving high-profile verified accounts. In June 2024, hackers hijacked Microsoft India’s X account to impersonate investor Keith Gill and promote a GameStop-related token, exposing followers to wallet-draining malware. Earlier, the U.S. Securities and Exchange Commission’s X account was compromised in January 2024, falsely announcing SEC approval of spot Bitcoin ETFs; the false post triggered a Bitcoin price surge of over $1,000 before the correction caused a drop of more than $2,000. Researchers also reported a compromised HBO Max Reddit account that pushed 108 malicious ads within roughly 48 hours. These cases illustrate how verification badges can lend credibility to fraudulent messages.
Risks Highlighted by the Attack
The incident underscores that a verified badge does not guarantee current control of an account. When a trusted account disseminates a crypto promotion, followers may lower their guard, click links, and potentially expose cryptocurrency wallets to malicious approvals or malware. The rapid market impact observed after the SEC hijack demonstrates how quickly false information can influence asset prices before organizations can issue corrections.
Recommendations for Users
Security experts advise several safeguards: verify surprising announcements on official company websites; be wary of sudden topic changes from accounts that normally discuss unrelated subjects; avoid connecting crypto wallets through social-media links; use strong, unique passwords and two-factor authentication; and pause before acting on urgent-sounding offers. If a link is clicked, close the page immediately; if credentials are entered, change passwords on the legitimate site and enable additional authentication measures. These steps can help mitigate the risk posed by compromised verified accounts.