Microsoft's X Account Hijacked to Promote Unofficial Clippy-Themed Meme Coin
Attackers hijacked Microsoft's official X account, posted about a Clippy-themed meme coin, and the account was secured about 30 minutes later.
Why it matters
Microsoft is not a cryptocurrency issuer, so the direct market effect is limited to an unauthorised token trading on a name it did not create. The episode is a further case of corporate X accounts being taken over to push fake tokens: Crypto.News notes earlier breaches of the accounts of Robinhood CEO Vlad Tenev and of accounts linked to SpaceX and Starlink, and Bitcoin Insider adds that Microsoft's India account was hacked in June 2024 to promote a fake GameStop token tied to Keith Gill. Companies named in such breaches carry legal exposure to the tokens marketed in their name.
Where the sources disagree
Whether the deleted statement distancing Microsoft from the Clippy token was genuine
Statement was genuinely issued by Microsoft and rejected the token's branding and share-backing claim
Crypto.News, Bitcoin Insider
The post was not published by Microsoft and was likely meant to confuse social media followers
U.Today, Bitcoin Insider
Crypto.News reports Microsoft itself issued a statement rejecting the token's branding and denying a link to MSFT shares, while U.Today says the post was not published by the company and appears to have been part of the attack, and Bitcoin Insider reports the two outlets disagree on this point.
Whether Microsoft posted an apology after the breach
Apology tweet appeared roughly 30 minutes later and was then deleted
Bitcoin.com News
No apology tweet mentioned in the report
Crypto News (CryptoNews.net)
Bitcoin.com News says an apology tweet appeared about 30 minutes after the posts were removed and was deleted almost immediately, a detail that does not appear in the accounts carried by Crypto News or Crypto.News.
Key facts
Attackers took control of Microsoft's official X account and used it to promote an unofficial Clippy-themed meme coin on Thursday, 2 October 2026.
Reported by Bitcoin.com News
The compromised account followed an account promoting the token, reposted one of its tweets and changed its own profile picture to Clippy.
Reported by Bitcoin.com News
The promotional posts were removed and the account secured roughly 30 minutes after the hijacked activity began.
Disputed figureReported by Bitcoin.com News
Microsoft told The Verge that it had confirmed unauthorized access to its X account, secured it, removed the unauthorized posts and was continuing to investigate.
Reported by Bitcoin.com News
A statement that appeared on Microsoft's account denied any connection between the Clippy token and Microsoft shares and said Microsoft would pursue legal action, and it was later deleted.
Disputed figureReported by Crypto.News
Token promoters claimed liquidity exceeded $200,000 and alleged backing by Microsoft stock without providing verified evidence.
200,000 USDReported by Crypto.News
U.Today reported that the token was presented as paired with Microsoft stock under the ticker MSTF, and that no legitimate connection existed.
Reported by U.Today
Earlier account breaches used the same playbook against Robinhood CEO Vlad Tenev, accounts associated with SpaceX and Starlink, and Microsoft's India account in June 2024, which pushed a fake GameStop token tied to Keith Gill.
Reported by Bitcoin.com News
What happened
Microsoft's official X account was hijacked on Thursday, 2 October 2026, and used to promote an unofficial meme coin inspired by the MSFT stock ticker and Clippy, the paperclip assistant from early Office releases, U.Today reported. The account followed an account promoting the token, reposted one of its tweets and changed its profile picture to Clippy, and the promotional posts came down about 30 minutes later. Bitcoin.com News reported that the account then posted an apology, which was deleted almost immediately, while Crypto.News said the statement rejected the token's use of Microsoft branding, denied any link between the token and Microsoft shares and promised legal action. Microsoft told The Verge that it had confirmed unauthorized access, secured the account, removed the unauthorized posts and was still investigating how the access happened; Crypto.News and U.Today both report that statement. Bitcoin Insider flags that Crypto.News and U.Today disagree on whether the deleted statement came from Microsoft at all, with U.Today saying the company itself never published the post and calling it a likely attempt to confuse followers. Promoters of the token claimed liquidity above $200,000 and alleged share backing without verified evidence, Crypto.News reported, and the pairing was described as being with MSTF stock. What is not established is how the attackers reached the account, whether any of them were the authors of the deleted post, and how much the campaign raised.
How the story developed
- First report
First report by Bitcoin.com News
Microsoft’s X Account Hijacked to Promote Clippy Meme Coin
- Update
Microsoft's X account begins promoting the Clippy token
The account follows the promoter's account, reposts a tweet and changes its profile picture to Clippy.
- Official statement
Microsoft confirms the breach to The Verge
Microsoft says it confirmed unauthorized access, secured the account, removed the unauthorized posts and is investigating the circumstances.
- Independent corroboration
Independently corroborated by Crypto.News
Hackers use Microsoft’s X account to push unofficial Clippy token
- Official statement
Deleted statement rejects the token and threatens legal action
A statement on Microsoft's account denies any connection between the Clippy token and MSFT shares and says Microsoft plans legal action, and is later deleted; whether Microsoft issued it is disputed.
- Update
Sourcing dispute over the deleted statement surfaced
Bitcoin Insider notes that Crypto.News and U.Today agree on the hijacking but disagree on whether the deleted statement came from Microsoft.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 2 Oct 2026, 21:40 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 3 Oct 2026, 09:25 UTC: Crypto.News — 2 independent sources, 3 reports
- 4 Oct 2026, 06:38 UTC: U.Today — 3 independent sources, 4 reports
- 4 Oct 2026, 06:55 UTC: Bitcoin Insider — 4 independent sources, 5 reports
Affected entities
Also mentioned: Bitcoin, Elon Musk
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Microsoft’s X Account Hijacked to Promote Clippy Meme Coin | Original | |
| Crypto.News Crypto media | Hackers use Microsoft’s X account to push unofficial Clippy token | Independent | |
| U.Today Crypto media | Microsoft X Account Hijacked to Promote Crypto Scam | Syndicated | |
| Crypto News (CryptoNews.net) Aggregator | Microsoft's X Account Hijacked to Promote Clippy Meme Coin | Syndicated | |
| Bitcoin Insider Aggregator | Was Microsoft’s Deleted Clippy Token Denial Real or Fake? | Syndicated |
Related events
Infosys and Chainlink to standardize CCIP, data feeds and compliance in banking systems
Infosys and Chainlink will standardize Chainlink's CCIP, data feeds and compliance tools inside banking infrastructure, including the Infosys Finacle platform, with no bank names or dates given.
Lloyds and Visa complete seven-day USDC cross-border settlement pilot moving $750,000
Lloyds Banking Group and Visa settled $750,000 in live cross-border obligations using USDC during a seven-day pilot, with funds reaching Visa in under an hour including weekends.
dtcpay closes $25 million Series A with SBI Group as strategic investor
Singapore stablecoin payments firm dtcpay completed a $25 million Series A after Japan's SBI Group joined as a strategic investor.
Citi overtakes Goldman Sachs in global IPO underwriting through September
CoinGape, citing Bloomberg, says Citi passed Goldman Sachs as top global IPO underwriter through September after roles on the SpaceX, SK Hynix and NSE listings.
Allahabad High Court denied habeas relief in Lucknow crypto fraud case
Crypto News reports India's Allahabad High Court dismissed habeas petitions from people arrested in an alleged Lucknow call-centre fraud that used fake officials, crypto wallets and QR codes.
Singapore crypto activity rose 55.4% to $284 billion, Chainalysis says, as CSAO region shrank 6.8%
Chainalysis put Singapore's crypto activity at $284 billion for July 2025 to June 2026, up 55.4%, while the wider CSAO region contracted 6.8%.