Attackers briefly took over Microsoft’s official Twitter/X account and rebranded it with a Clippy avatar to push a Clippy-themed cryptocurrency scam. Posts suggested the token was tied to Microsoft’s stock price, potentially tricking followers into thinking it was legitimate. A fake “corporate” apology was also posted and then deleted, adding confusion.
Attackers gained control of Microsoft's official Twitter/X account, a verified channel followed by 13 million people, and used it to promote a cryptocurrency scam. The account's avatar was swapped to the Clippy mascot, and the compromised account was made to follow and share posts from a Clippy-themed crypto account. A related account then promoted a token called Clippy Coin, falsely implying its liquidity was paired with Microsoft's stock price, a claim designed to make the token feel connected to a real, trusted company.
The exact method used to take over the account was not confirmed. Possibilities discussed included phishing, SIM swapping, abuse of password reset processes, or theft of session cookies. This uncertainty is itself a useful reminder: account takeovers can happen through several different paths, and defenders should not assume a single attack vector when responding.
The scam leaned heavily on borrowed trust. A verified, high-follower corporate account posting about a token gives that token instant credibility it would never earn on its own. Tying the coin's claimed liquidity to Microsoft's stock price added a veneer of legitimacy that could mislead casual observers into thinking there was a real corporate connection, even though there wasn't. A fake title reference, framing a Clippy persona as if it were Microsoft's CTO, added another layer of false authority.
The situation was made more confusing by a formal-sounding apology and disclaimer that was posted from the hacked account and then deleted. Microsoft later confirmed that apology wasn't from them either, showing that even damage-control messages from a compromised channel cannot be trusted at face value.
Organizations and individuals who follow major brands should treat unexpected social media "announcements," especially those involving cryptocurrency, as potentially the product of a hijacked account until verified elsewhere. Verification should happen through a second official channel, such as a company's main website or press statement, rather than by trusting the social account itself. Social media managers, marketing and communications teams, and executives are especially relevant audiences here, since they are often the ones best positioned to confirm or deny suspicious posts quickly. Building a habit of pausing before sharing or acting on a brand's social post, particularly one involving money or investment, can reduce the spread of this kind of scam.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers hijacked Microsoft's official Twitter/X account, which had 13 million followers, and changed its profile image to Clippy to promote a crypto token.
A related account promoted a 'Clippy Coin' and falsely claimed its liquidity was paired with Microsoft's stock price, which may have made followers think it was connected to Microsoft's actual stock.
No. A formal-looking apology and disclaimer was posted from the hacked account and later deleted, and Microsoft confirmed that the apology was not from them either.
The exact compromise method was not confirmed; speculated possibilities included phishing, SIM swap, password reset abuse, or stolen session cookies.
Someone pretending to be Clippy took over Microsoft’s official X account and started shilling a fake “Clippy Coin.” They swapped the picture for Clippy, followed a Clippy-themed crypto account, and boosted posts claiming “Clippy Coin” was paired with Microsoft’s stock price, making it look official when it wasn’t. Then a very corporate-sounding apology appeared on the same account and was deleted later. That apology was fake too. Once an account’s hijacked, every post on it is suspect. If you see a sudden crypto “announcement” from any brand, pause. Don’t click, don’t share, go to the company’s main website or another official channel and verify it there first.
Researchers tied several new programs to the REVSTEALER Windows info-stealer that can steal crypto wallet data, hijack clipboard crypto addresses, and even disable Windows Update and Microsoft Defender to run a crypto miner. Victims are primarily pulled in through “game-cheat” downloads promoted by…
People are receiving iMessage texts that look like a buyer asking about a Facebook Marketplace item, but the attached listing is fake and shows the recipient’s own name as the seller. The personalization is designed to trigger a quick reply (“That isn’t me”), which confirms the phone number is…
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
A University of Texas at Dallas student spotted a malicious pull request on GitHub and warned the project owner, only to be publicly challenged by what appeared to be other developers. UK officials later said those “people” were fake personas operated by an AI agent, which tried to discredit the…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
