Why verified social media accounts can still lead you into a scam
Microsoft’s X account briefly falls victim to cryptocurrency scam, posts removed
A verified Microsoft X (formerly Twitter) account was compromised in a short‑lived hacking incident that saw the posting of two messages promoting a cryptocurrency called $Clippy. The account, which has more than 13 million followers, was used to amplify the promotion of the token, potentially giving scammers a large and credible audience. Microsoft has confirmed the breach, removed the unauthorized content, and is investigating how the attackers gained control.
The first post was a “quote‑repost” from a Clippy‑themed X account that urged users to “bring back the old animated paperclip” and promoted the new crypto. The second message appeared to be an apology for the earlier activity. Microsoft said neither message originated from its own staff or was approved by the company.
“We have confirmed unauthorized access to our account on X, including posts that did not originate from Microsoft. The account has been secured, the unauthorized posts have been removed, and we are continuing to investigate the circumstances,” a Microsoft spokesperson told reporters. The company also stated that it had taken steps to secure its X presence and was working with investigators to understand the breach.
How the takeover happened
While Microsoft did not disclose the exact method the attackers used, the incident underscores how vulnerable even the most trusted social‑media accounts can be. In other high‑profile cases, attackers have employed SIM‑swap attacks or phishing to obtain account credentials and then take control of verified profiles. Once a verified badge is in place, users are often less skeptical of content, which can allow scammers to spread misinformation, “pump‑and‑dump” schemes or malicious links before the genuine organization can react.
The $Clippy token was promoted by an X account that mimicked the iconic Microsoft Office paperclip character. The account had no prior connection to Microsoft, yet the use of Microsoft’s verified account lent it an aura of legitimacy that could have encouraged users to invest or interact with the token.
Broader context
This is not the first time Microsoft’s X accounts have been compromised for malicious purposes. In June 2024, hackers hijacked the Microsoft India X account and used it to impersonate investor Keith Gill, promoting a GameStop‑related cryptocurrency presale that reportedly lured users into wallet‑draining malware. Earlier that year, the U.S. Securities and Exchange Commission’s verified X account was briefly taken over in a SIM‑swap attack that falsely announced approval of spot Bitcoin exchange‑traded funds. The false post caused Bitcoin to surge more than $1,000 before the SEC corrected the misinformation, after which the price fell over $2,000.
These incidents highlight the high stakes of account takeovers. A single compromised post can influence market sentiment, lead to loss of investor confidence, and expose users to phishing or malware attacks.
Impact on the crypto community
Cryptocurrency traders and enthusiasts who saw Microsoft’s X account promoting $Clippy may have been tempted by the perceived endorsement from a major tech company. While it is unclear how many users acted on the promotion, the incident illustrates how quickly a scam can gain traction when it is backed by a large, verified following.
The cryptocurrency market’s volatility means that even a single misleading message can have ripple effects. Analysts noted that the $Clippy token’s price spiked briefly after the posts appeared but fell back sharply once the scam was uncovered and the account was secured.
Microsoft’s response and security measures
After the posts were identified, Microsoft removed the two unauthorized messages and restored the account to its normal posting schedule. The company also announced that it was reviewing its security posture on X and other social‑media platforms, including the use of multi‑factor authentication for staff and tighter controls on account recovery procedures.
Microsoft’s spokesperson emphasized that the verification badge does not guarantee that an account is currently controlled by the organization it claims to represent. “A verified account can still be compromised, and it is essential for users to remain vigilant and verify any unusual or money‑related requests through official channels,” the spokesperson added.
What to do if you encounter suspicious posts
While Microsoft’s incident is a reminder that no account is immune, it does not mean that all verified accounts should be automatically distrusted. Experts advise users to be cautious when a seemingly legitimate account suddenly posts about a new cryptocurrency, investment opportunity, or other financial offer. Checking the company’s own website or other official communication channels before acting can help avoid falling victim to scams that exploit the credibility of verified profiles.
The incident also reinforces the importance of strong security practices, such as using unique passwords, enabling robust two‑factor authentication, and monitoring account activity for unfamiliar sessions. In the evolving landscape of social‑media fraud, vigilance remains the most effective defense.
Moving forward
Microsoft has stated that it will continue to work with investigators to determine the exact vector used in this hack and to strengthen its security protocols. The company’s quick removal of the unauthorized posts and public statement are viewed by many as appropriate first steps in restoring user confidence.
As the cryptocurrency ecosystem continues to grow and attract both legitimate projects and opportunistic scammers, the incident serves as a cautionary tale about the power and potential danger of verified social‑media accounts in shaping market narratives.