Early this month, attackers took over Microsoft's official X account, about 13 million followers, and used it to promote a crypto token called $Clippy, named after the old Office paperclip. Microsoft says the account is secured, the posts are gone, and it never endorsed any token. The scam is old. The account it borrowed was not.

What happened

The @Microsoft account followed and reposted an account pretending to be Clippy, which has since been suspended. Another account kept pushing $Clippy, claiming it had a liquidity pool "paired directly with $MSFT". One report says the account was out of Microsoft's hands for about half an hour. Microsoft said the account "has been secured", the unauthorized posts were removed, and it is still investigating. It hasn't said how the attackers got in.

Why the pitch was impossible

A crypto token can't be "paired" with a company's stock. A liquidity pool pairs two tokens on a blockchain. Microsoft shares trade on the Nasdaq. That one line was enough to show the whole thing was made up, but most people buying in the first minutes never read that far.

The playbook

Borrow a famous account. Launch a brand-new token. Pump it while the screenshots spread. Sell before anyone checks. The people who lose are the ones who buy because a big name said so. The same move hit the SEC's own X account in 2024.

What to do

  • A blue check tells you who owns the account. It doesn't tell you who's typing.
  • If a big brand suddenly posts about a token, check the company's own website and press page first.
  • Run the token checks before you buy anything: can you sell it, is the liquidity locked, who holds the supply. Our rug pull checklist walks you through it.

Sources: BleepingComputer, SecurityWeek, TechRadar.