- Microsoft’s X account was hijacked to promote the suspicious $CLIPPY cryptocurrency token
- Attackers amplified the scam with fake Microsoft-branded statements and apology posts
- Microsoft confirmed unauthorized access, removed the posts, and secured the account
Cybercriminals managed to briefly take over Microsoft’s X account and used it to promote a cryptocurrency-themed scam. To make matters even worse, they later tried to make it seem as if Microsoft reclaimed its account and issued a fake apology tweet.
The wonderful world of cryptocurrency has a subculture called “meme coins”. These are obscure, practically pointless tokens that emerge quickly as part of an ongoing trend, and disappear just as fast. For example, there was a token called SQUID that emerged while the Squid Game series was popular, and there was one called HAWK that rose while the “Hawk Tuah” girl was popular on the internet.
While not a rule, these coins are also often scams. Community members purchase them, allowing the creators to extract value before disappearing. SQUID was worth around $2,800 per token at its peak, and collapsed to $0.0008 within minutes, while HAWK lost around 90% of its value almost immediately after launch.
Enter Clippy
It seems that the latest meme coin to be used this way is called CLIPPY – based on the infamous virtual assistant that was introduced with Office 97.
For those of younger age, earlier versions of Microsoft Office came with a virtual assistant that would pop up at the bottom right of the screen and ask if the user needed any help. It was designed as a large paperclip with eyes, and was discontinued a few years later for being practically useless and annoying.
Since then, however, Clippy has become an internet meme, and something to be fondly remembered, particularly in today’s world of cold, calculated, heartless AI agents. Clippy has become a symbol of warmer, more humane time of computing, and as such it, too, was abused in a scam.
As part of the scam, the fraudsters created a Clippy X account, called “ClippyMSFTCo”, and posted a call to action: “How many likes to bring Clippy back? @microsoft give us a number, please.” Then they hijacked Microsoft’s official account and retweeted this post to their audience of 13 million.
But promoting an obvious scam to millions of people trusting Microsoft was only half of the ruse. They later deleted the original post and issued a bizarre public apology:
“We are aware of a cryptocurrency token being promoted in connection with $MSFT stock, including the unauthorized use of the Clippy brand and Microsoft-related intellectual property,” the scammers wrote. “Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT.”
This post was later deleted, as well.
Build your own Clippy
Musk’s social network has later disabled the fraudulent @clippymsftcto account. However, researchers fromCybernews later found a different account – @ClippyMSFT, still promoting the $CLIPPY token, stating it “has a liquidity pool paired directly with $MSFT.”
“For the first time ever, everyone’s favorite paperclip has a liquidity pool paired directly with $MSFT, the company that built him is now the floor under his bags,” one tweet reads. A separate tweet also promoted software that allows users to “build their own Clippy” which, if this author has learned anything over the years, sounds a lot like a way to distribute malware. In this particular case – possibly a cryptocurrency stealer.
Microsoft has later spoken up, telling the media that its account was compromised and abused in a scam: “We have confirmed unauthorized access to our account on X, including posts that did not come from Microsoft,” Microsoft spokesperson Brent Colburn said. “The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”
