Microsoft X account hijack — Fake Clippy token pumped to 13M followers

On Thursday Oct 1, 2026 the official Microsoft X account (about 13M followers) was taken over for roughly 30 minutes. The attacker changed the profile picture, reposted content from the @clippymsftcto account (since suspended) and posted a message promising to 'bring Clippy back' at 500,000 likes, followed by an unauthorized apology post; the posts promoted a crypto token. Microsoft confirmed unauthorized access, said it had secured the account and denied any involvement in a token; the intrusion method was not disclosed. Coverage by Microsoft's spokesperson, SecurityWeek, BleepingComputer, PCMag, WindowsLatest and Crypto Briefing followed on Oct 1-2. Promoters claimed that the token's pools were backed by real Microsoft shares and valued them above $200,000. The most plausible candidate, a CLIPPY/MSFT pool on Robinhood Chain, existed since mid-July, which would mean the hijack relaunched an existing token; this link remains unproven (no article gives the promoted token's address and the Oct 1 price spike was not verified). No financial loss has been quantified.