Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingHackers hijacked Microsoft's official X account and promoted fraudulent tokens with a fake "Clippy Returns" campaign.
Hackers hijacked Microsoft's official account on the X platform (formerly Twitter) and promoted a fraudulent cryptocurrency token called $Clippy through a fake "resurrection assistant Clippy" campaign. At the same time, a forged Microsoft apology was released, claiming legal action would be taken against those responsible, a move aimed at confusing the public and making it difficult for followers to identify who controlled the compromised account.
Fraud with nostalgia
According to Bleeping Computer, the intrusion turned Microsoft's classic paperclip assistant image into fraud bait. The attacker posted posts through Microsoft's official profile page to promote the coin. They reprinted content from related accounts and promoted the so-called $Clippy token on Microsoft's hijacked social media homepage.
One of the messages promised that if the post received 500,000 likes, Microsoft would bring Clippy back to the public eye. The event encourages users to engage in this nostalgic interaction, while also focusing attention on cryptocurrencies that lack official Microsoft support. Promotional material also claims that the token is pegged to Microsoft stock and uses the "MSTF" tag to imply its association with businesses. However, in fact there was no legal relationship to support this statement, and the X platform subsequently suspended the operation of the fraudulent account.
Details about the breach are still limited, including how the attacker accessed Microsoft accounts and how much illegal proceeds the activity generated are unknown.
Forging apology letters exacerbating confusion
After the promotional post was posted, an apology statement appeared to be from Microsoft, ostensibly rejecting such scams and threatening legal action against those responsible. However, this is not official news released by Microsoft, but is part of the entire cryptocurrency fraud campaign. The forged statement appears to be designed to confuse followers about whether Microsoft has regained control of its accounts. By spreading so-called corporate responses along with fraudulent promotional content, the campaign blurs the line between attacker behavior and true official communication.
Similar cases occur in history
Microsoft has encountered similar account breaches before. For example, in June 2024, his Indian account was attacked to promote GameStop-related cryptocurrency pre-sales activities, citing the image of Keith Gill (better known by netizens as Roaring Kitty). According to reports, the account at the time directed users to a website that could steal their cryptocurrency wallets. Although both events leveraged Microsoft's brand identity, the case in India involved more dangerous website links rather than just using nostalgia to promote tokens.
Currently, the financial impact of Clippy's activities has not yet been announced, and questions about how attackers obtained permissions and the company's recovery response remain to be answered.
