Threat Intelligence & APT SecurityWeek 2 weeks ago

Crypto Scammers Hijack Microsoft’s Official X Account

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft has confirmed that its official X account was taken over on Thursday and used to amplify a Clippy-themed cryptocurrency account. According to The Verge , the company’s account, which has more than 13 million followers, started following the crypto account and shared one of its messages. Microsoft’s profile picture was also replaced with an image of Clippy, the animated paperclip..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Microsoft X account hacked

Microsoft has confirmed that its official X account was taken over on Thursday and used to amplify a Clippy-themed cryptocurrency account. 

According to The Verge, the company’s account, which has more than 13 million followers, started following the crypto account and shared one of its messages. Microsoft’s profile picture was also replaced with an image of Clippy, the animated paperclip assistant that shipped with older versions of Office.

The account behind the reposted message, @clippymsftcto, posed as Clippy and has since been suspended. A second account involved in the incident kept pushing a $Clippy token, saying its liquidity pool was paired with $MSFT.

The posts were eventually taken down. According to The Verge, an apology appeared on the Microsoft account roughly 30 minutes later and was deleted soon after, with no explanation given.

The now-deleted post said Microsoft was aware of a token being marketed in connection with its stock that used the Clippy brand without permission. “To be clear, Microsoft does not support, endorse, sponsor, or authorize any cryptocurrency or crypto-related token,” it read.

A Microsoft spokesperson told The Verge, “We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft,” adding, “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”

Advertisement. Scroll to continue reading.

Written By Eduard Kovacs

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →